@secureci/cli 0.0.0-stage → 0.1.1

package/dist/parser/workflow-parser.js

@@ -0,0 +1,122 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseWorkflow = parseWorkflow;
+exports.parseAction = parseAction;
+exports.parseFile = parseFile;
+const fs = __importStar(require("fs"));
+const YAML = __importStar(require("yaml"));
+/**
+ * Parse a GitHub workflow YAML file
+ */
+function parseWorkflow(filePath) {
+    if (!fs.existsSync(filePath)) {
+        throw new Error(`Workflow file not found: ${filePath}`);
+    }
+    const content = fs.readFileSync(filePath, 'utf-8');
+    try {
+        const parsed = YAML.parse(content);
+        if (!parsed.name) {
+            throw new Error('Workflow must have a name');
+        }
+        if (!parsed.jobs || Object.keys(parsed.jobs).length === 0) {
+            throw new Error('Workflow must have at least one job');
+        }
+        return {
+            type: 'workflow',
+            file: parsed,
+            path: filePath
+        };
+    }
+    catch (error) {
+        if (error instanceof Error) {
+            throw new Error(`Failed to parse workflow: ${error.message}`);
+        }
+        throw error;
+    }
+}
+/**
+ * Parse a GitHub action YAML file
+ */
+function parseAction(filePath) {
+    if (!fs.existsSync(filePath)) {
+        throw new Error(`Action file not found: ${filePath}`);
+    }
+    const content = fs.readFileSync(filePath, 'utf-8');
+    try {
+        const parsed = YAML.parse(content);
+        if (!parsed.name) {
+            throw new Error('Action must have a name');
+        }
+        if (!parsed.description) {
+            throw new Error('Action must have a description');
+        }
+        if (!parsed.runs) {
+            throw new Error('Action must have a runs section');
+        }
+        return {
+            type: 'action',
+            file: parsed,
+            path: filePath
+        };
+    }
+    catch (error) {
+        if (error instanceof Error) {
+            throw new Error(`Failed to parse action: ${error.message}`);
+        }
+        throw error;
+    }
+}
+/**
+ * Auto-detect and parse either workflow or action file
+ */
+function parseFile(filePath) {
+    if (!fs.existsSync(filePath)) {
+        throw new Error(`File not found: ${filePath}`);
+    }
+    const content = fs.readFileSync(filePath, 'utf-8');
+    const parsed = YAML.parse(content);
+    // Detect if it's a workflow or action based on structure
+    if (parsed.jobs) {
+        return parseWorkflow(filePath);
+    }
+    else if (parsed.runs) {
+        return parseAction(filePath);
+    }
+    else {
+        throw new Error('Unable to determine file type. Must be either a workflow (with jobs) or action (with runs)');
+    }
+}
+//# sourceMappingURL=workflow-parser.js.map

package/dist/report.js

@@ -0,0 +1,75 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.formatReport = formatReport;
+exports.formatValidation = formatValidation;
+/** A SARIF rule id per error, so code-scanning can group findings. */
+function ruleIdFor(error) {
+    if (/^required\[|^forbidden\[/.test(error.path))
+        return 'secureci/contract';
+    if (/\.if$|\bif:/.test(error.path))
+        return 'secureci/expression';
+    return 'secureci/validation';
+}
+const RULES = {
+    'secureci/validation': 'Workflow or action structure',
+    'secureci/contract': 'Pipeline contract',
+    'secureci/expression': 'Expression / if: condition'
+};
+function jsonForFile(entry) {
+    return {
+        file: entry.file,
+        valid: entry.result.valid,
+        errors: entry.result.errors.map((e) => ({
+            path: e.path,
+            message: e.message,
+            severity: e.severity
+        }))
+    };
+}
+function sarifResults(entry) {
+    return entry.result.errors.map((error) => ({
+        ruleId: ruleIdFor(error),
+        level: error.severity === 'warning' ? 'warning' : 'error',
+        message: { text: `${error.path}: ${error.message}` },
+        locations: [{ physicalLocation: { artifactLocation: { uri: entry.file } } }]
+    }));
+}
+/**
+ * Render one or more validated files for `--format`. `json` is a compact
+ * object (a single file keeps the flat `{ file, valid, errors }` shape; many
+ * files become `{ valid, files: [...] }`). `sarif` is one SARIF 2.1.0 run
+ * carrying every file's findings, suitable for GitHub code scanning (upload
+ * with `github/codeql-action/upload-sarif`).
+ */
+function formatReport(entries, format) {
+    if (format === 'json') {
+        const body = entries.length === 1
+            ? jsonForFile(entries[0])
+            : {
+                valid: entries.every((e) => e.result.valid),
+                files: entries.map(jsonForFile)
+            };
+        return JSON.stringify(body, null, 2);
+    }
+    return JSON.stringify({
+        $schema: 'https://json.schemastore.org/sarif-2.1.0.json',
+        version: '2.1.0',
+        runs: [
+            {
+                tool: {
+                    driver: {
+                        name: 'secureci',
+                        informationUri: 'https://www.secure-ci.dev',
+                        rules: Object.entries(RULES).map(([id, name]) => ({ id, name }))
+                    }
+                },
+                results: entries.flatMap(sarifResults)
+            }
+        ]
+    }, null, 2);
+}
+/** Render a single validated file (see formatReport). */
+function formatValidation(file, result, format) {
+    return formatReport([{ file, result }], format);
+}
+//# sourceMappingURL=report.js.map

package/dist/runner/action-fetcher.js

@@ -0,0 +1,431 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseActionReference = parseActionReference;
+exports.getActionCacheDir = getActionCacheDir;
+exports.githubToken = githubToken;
+exports._resetGithubTokenForTests = _resetGithubTokenForTests;
+exports.lsRemoteSha = lsRemoteSha;
+exports.fetchAction = fetchAction;
+exports.fetchRepoFile = fetchRepoFile;
+exports.clearActionCache = clearActionCache;
+exports.resolveActionSha = resolveActionSha;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const http = __importStar(require("http"));
+const https = __importStar(require("https"));
+const util_1 = require("util");
+const child_process_1 = require("child_process");
+const logger_1 = require("../utils/logger");
+const execFileAsync = (0, util_1.promisify)(child_process_1.execFile);
+/** Default connect/idle timeout for action downloads. */
+const DOWNLOAD_TIMEOUT_MS = 30000;
+const MAX_REDIRECTS = 5;
+/**
+ * Parse an action reference like "actions/checkout@v3" or "owner/repo/path@ref"
+ */
+function parseActionReference(uses) {
+    // Format: owner/repo[@ref] or owner/repo/path[@ref]
+    const match = uses.match(/^([^/]+)\/([^/@]+)(?:\/([^@]+))?@(.+)$/);
+    if (!match) {
+        logger_1.logger.warn(`Invalid action reference format: ${uses}`);
+        return null;
+    }
+    const [, owner, repo, actionPath, ref] = match;
+    return {
+        owner,
+        repo,
+        ref,
+        path: actionPath || undefined
+    };
+}
+/** The cache directory for downloaded actions and repositories. */
+function getActionCacheDir() {
+    const homeDir = process.env.HOME || process.env.USERPROFILE || '/tmp';
+    return path.join(homeDir, '.secureci', 'actions-cache');
+}
+let discoveredToken;
+/**
+ * A GitHub token for downloading actions: $GITHUB_TOKEN, $GH_TOKEN, else
+ * `gh auth token`. Only ever sent to the GitHub API/server, never passed
+ * to actions, and masked in logs.
+ */
+function githubToken() {
+    if (discoveredToken !== undefined)
+        return discoveredToken;
+    let token = process.env.GITHUB_TOKEN || process.env.GH_TOKEN || '';
+    if (!token) {
+        try {
+            token = (0, child_process_1.execFileSync)('gh', ['auth', 'token'], {
+                encoding: 'utf8',
+                stdio: ['ignore', 'pipe', 'ignore'],
+                timeout: 3000
+            }).trim();
+        }
+        catch {
+            token = '';
+        }
+    }
+    discoveredToken = token || null;
+    if (token)
+        logger_1.logger.registerSecrets({ 'github-token': token });
+    return discoveredToken;
+}
+/** Test-only: forget the discovered token. */
+function _resetGithubTokenForTests() {
+    discoveredToken = undefined;
+}
+function serverUrl() {
+    return (process.env.GITHUB_SERVER_URL || 'https://github.com').replace(/\/+$/, '');
+}
+function apiUrl() {
+    if (process.env.GITHUB_API_URL) {
+        return process.env.GITHUB_API_URL.replace(/\/+$/, '');
+    }
+    const server = serverUrl();
+    return server === 'https://github.com'
+        ? 'https://api.github.com'
+        : `${server}/api/v3`;
+}
+const FULL_SHA = /^[0-9a-f]{40}$/i;
+/**
+ * The commit a branch or tag points at, via `git ls-remote` (anonymous, so
+ * no API rate limit). Annotated tags resolve to their commit.
+ */
+async function lsRemoteSha(url, ref) {
+    let output;
+    try {
+        ({ stdout: output } = await execFileAsync('git', [
+            'ls-remote',
+            url,
+            `refs/tags/${ref}`,
+            `refs/tags/${ref}^{}`,
+            `refs/heads/${ref}`
+        ], {
+            encoding: 'utf8',
+            timeout: 15000,
+            env: { ...process.env, GIT_TERMINAL_PROMPT: '0' }
+        }));
+    }
+    catch {
+        return undefined;
+    }
+    const refs = new Map();
+    for (const line of output.split('\n')) {
+        const [sha, name] = line.trim().split(/\s+/);
+        if (sha && name)
+            refs.set(name, sha);
+    }
+    return (refs.get(`refs/tags/${ref}^{}`) ??
+        refs.get(`refs/tags/${ref}`) ??
+        refs.get(`refs/heads/${ref}`));
+}
+/** GET a small text response (the API commit lookup). */
+function getText(url, headers, timeoutMs) {
+    return new Promise((resolve, reject) => {
+        const client = url.startsWith('http://') ? http : https;
+        const request = client.get(url, { headers }, (response) => {
+            let body = '';
+            response.setEncoding('utf8');
+            response.on('data', (chunk) => (body += chunk));
+            response.on('end', () => response.statusCode === 200
+                ? resolve(body)
+                : reject(Object.assign(new Error(`HTTP ${response.statusCode}`), {
+                    status: response.statusCode
+                })));
+            response.on('error', reject);
+        });
+        request.setTimeout(timeoutMs, () => request.destroy(new Error(`Timed out after ${timeoutMs}ms: ${url}`)));
+        request.on('error', reject);
+    });
+}
+/**
+ * The commit SHA for `ref`, or undefined if it can't be resolved now.
+ * `unauthorized` is set when GitHub rejected the token.
+ */
+async function resolveSha(ref, token, timeoutMs) {
+    if (FULL_SHA.test(ref.ref))
+        return { sha: ref.ref.toLowerCase() };
+    if (token) {
+        try {
+            const sha = (await getText(`${apiUrl()}/repos/${ref.owner}/${ref.repo}/commits/${encodeURIComponent(ref.ref)}`, {
+                ...requestHeaders(token),
+                Accept: 'application/vnd.github.sha'
+            }, timeoutMs)).trim();
+            return { sha: FULL_SHA.test(sha) ? sha.toLowerCase() : undefined };
+        }
+        catch (error) {
+            return { unauthorized: error.status === 401 };
+        }
+    }
+    return {
+        sha: await lsRemoteSha(`${serverUrl()}/${ref.owner}/${ref.repo}.git`, ref.ref)
+    };
+}
+/**
+ * Download a URL to a file, following up to MAX_REDIRECTS redirects. The
+ * Authorization header is only sent to the original host (GitHub's API
+ * redirects tarballs to a pre-signed codeload URL). Every response that
+ * isn't piped to the file is drained, so the socket is released, and the
+ * request is aborted if it stalls for `timeoutMs`.
+ */
+function downloadFile(url, dest, timeoutMs, headers, redirectsLeft = MAX_REDIRECTS) {
+    return new Promise((resolve, reject) => {
+        const client = url.startsWith('http://') ? http : https;
+        const request = client.get(url, { headers }, (response) => {
+            const status = response.statusCode ?? 0;
+            if ([301, 302, 303, 307, 308].includes(status)) {
+                response.resume();
+                const location = response.headers.location;
+                if (!location) {
+                    reject(new Error(`Redirect (${status}) without a Location header`));
+                }
+                else if (redirectsLeft <= 0) {
+                    reject(new Error(`Too many redirects downloading ${url}`));
+                }
+                else {
+                    const next = new URL(location, url);
+                    const nextHeaders = { ...headers };
+                    if (next.host !== new URL(url).host) {
+                        delete nextHeaders.Authorization;
+                    }
+                    downloadFile(next.toString(), dest, timeoutMs, nextHeaders, redirectsLeft - 1).then(resolve, reject);
+                }
+                return;
+            }
+            if (status !== 200) {
+                response.resume();
+                const hint = status === 404
+                    ? headers.Authorization
+                        ? ' (check the action name and ref, and that your token can read the repository)'
+                        : ' (check the action name and ref; for a private repository, set GITHUB_TOKEN or log in with `gh auth login`)'
+                    : '';
+                reject(new Error(`Failed to download: ${status}${hint}`));
+                return;
+            }
+            const file = fs.createWriteStream(dest);
+            response.pipe(file);
+            file.on('finish', () => file.close(() => resolve()));
+            file.on('error', reject);
+            response.on('error', reject);
+        });
+        request.setTimeout(timeoutMs, () => {
+            request.destroy(new Error(`Download timed out after ${timeoutMs}ms: ${url}`));
+        });
+        request.on('error', reject);
+    });
+}
+function requestHeaders(token) {
+    return {
+        'User-Agent': 'secureci-cli',
+        ...(token ? { Authorization: `Bearer ${token}` } : {})
+    };
+}
+/** Where a repository's commits are cached, and its ref -> SHA index. */
+function repoCacheDir(ref) {
+    return path.join(getActionCacheDir(), ref.owner.toLowerCase(), ref.repo.toLowerCase());
+}
+function readRefIndex(dir) {
+    try {
+        return JSON.parse(fs.readFileSync(path.join(dir, 'refs.json'), 'utf8'));
+    }
+    catch {
+        return {};
+    }
+}
+function writeRefIndex(dir, refs) {
+    fs.writeFileSync(path.join(dir, 'refs.json'), JSON.stringify(refs, null, 2));
+}
+/**
+ * Download (or reuse from the cache) the repository tree of an action
+ * reference, keyed by commit SHA: a tag or SHA is fetched once, and a
+ * moving ref (`@main`) is re-resolved on every run, so new commits are
+ * picked up. If the ref can't be resolved (offline, rate-limited), the
+ * last commit cached for it is used. Returns the repository root.
+ */
+async function fetchRepository(ref, uses, options) {
+    const dir = repoCacheDir(ref);
+    const refs = readRefIndex(dir);
+    const cachedSha = FULL_SHA.test(ref.ref)
+        ? ref.ref.toLowerCase()
+        : refs[ref.ref];
+    const cached = (sha) => sha && fs.existsSync(path.join(dir, sha)) ? path.join(dir, sha) : null;
+    if (options.offline) {
+        const root = cached(cachedSha);
+        if (!root) {
+            logger_1.logger.error(`Action ${uses} is not cached (offline mode)`);
+        }
+        return root;
+    }
+    const timeoutMs = options.timeoutMs ?? DOWNLOAD_TIMEOUT_MS;
+    let token = options.token === undefined ? githubToken() : options.token;
+    const resolved = await resolveSha(ref, token, timeoutMs);
+    let sha = resolved.sha;
+    if (resolved.unauthorized) {
+        // An expired or revoked token shouldn't break public actions.
+        logger_1.logger.warn('GitHub rejected the token (401); continuing without it for this run');
+        if (options.token === undefined)
+            discoveredToken = null;
+        token = null;
+        ({ sha } = await resolveSha(ref, token, timeoutMs));
+    }
+    if (sha && cached(sha)) {
+        logger_1.logger.debug(`Using cached action: ${uses} (${sha.slice(0, 7)})`);
+        return cached(sha);
+    }
+    if (!sha && cached(cachedSha)) {
+        logger_1.logger.warn(`Could not resolve ${uses}; using the cached commit ${cachedSha.slice(0, 7)}`);
+        return cached(cachedSha);
+    }
+    logger_1.logger.info(`Fetching action: ${uses}`);
+    // Without a SHA (e.g. no token and no git), download by ref name into a
+    // slot that is replaced on every run rather than trusted later.
+    const key = sha ?? `unresolved-${ref.ref.replace(/[^\w.-]/g, '_')}`;
+    const target = path.join(dir, key);
+    const createdDir = !fs.existsSync(dir);
+    fs.mkdirSync(dir, { recursive: true });
+    const tmp = fs.mkdtempSync(path.join(dir, '.download-'));
+    try {
+        const url = token
+            ? `${apiUrl()}/repos/${ref.owner}/${ref.repo}/tarball/${sha ?? ref.ref}`
+            : `${serverUrl()}/${ref.owner}/${ref.repo}/archive/${sha ?? ref.ref}.tar.gz`;
+        const tarballPath = path.join(tmp, 'source.tar.gz');
+        logger_1.logger.debug(`Downloading from: ${url}`);
+        await downloadFile(url, tarballPath, timeoutMs, requestHeaders(token));
+        const extractDir = path.join(tmp, 'extracted');
+        fs.mkdirSync(extractDir);
+        await execFileAsync('tar', ['-xzf', tarballPath, '-C', extractDir]);
+        // GitHub tarballs hold a single top-level directory.
+        const [top] = fs.readdirSync(extractDir);
+        if (!top)
+            throw new Error('No files extracted from tarball');
+        fs.rmSync(target, { recursive: true, force: true });
+        fs.renameSync(path.join(extractDir, top), target);
+        if (sha) {
+            writeRefIndex(dir, { ...readRefIndex(dir), [ref.ref]: sha });
+        }
+        logger_1.logger.success(`Action fetched successfully: ${uses}`);
+        return target;
+    }
+    catch (error) {
+        logger_1.logger.error(`Failed to fetch action ${uses}: ${error instanceof Error ? error.message : 'Unknown error'}`);
+        if (createdDir) {
+            // Don't leave an empty cache entry behind.
+            fs.rmSync(path.join(getActionCacheDir(), ref.owner.toLowerCase()), {
+                recursive: true,
+                force: true
+            });
+        }
+        return null;
+    }
+    finally {
+        fs.rmSync(tmp, { recursive: true, force: true });
+    }
+}
+/** `root/sub`, or null if `sub` escapes `root`. */
+function within(root, sub = '') {
+    const resolved = path.resolve(root, sub);
+    return resolved === root || resolved.startsWith(root + path.sep)
+        ? resolved
+        : null;
+}
+/**
+ * Download a remote GitHub action, using the local cache when possible,
+ * and return the path to its action.yml / action.yaml.
+ */
+async function fetchAction(uses, options = {}) {
+    const ref = parseActionReference(uses);
+    if (!ref)
+        return null;
+    const root = await fetchRepository(ref, uses, options);
+    if (!root)
+        return null;
+    const actionDir = within(root, ref.path);
+    for (const name of ['action.yml', 'action.yaml']) {
+        const file = actionDir && path.join(actionDir, name);
+        if (file && fs.existsSync(file))
+            return file;
+    }
+    logger_1.logger.error(`No action.yml or action.yaml found in ${uses}`);
+    return null;
+}
+/**
+ * Download the repository of `owner/repo/path/to/file@ref` (e.g. a remote
+ * reusable workflow) and return the path to that file, or null.
+ */
+async function fetchRepoFile(uses, options = {}) {
+    const ref = parseActionReference(uses);
+    if (!ref?.path)
+        return null;
+    const root = await fetchRepository(ref, uses, options);
+    const file = root && within(root, ref.path);
+    if (file && fs.existsSync(file) && fs.statSync(file).isFile())
+        return file;
+    if (root)
+        logger_1.logger.error(`File not found in ${uses}`);
+    return null;
+}
+/**
+ * Clear the action cache
+ */
+function clearActionCache() {
+    const cacheDir = getActionCacheDir();
+    if (fs.existsSync(cacheDir)) {
+        fs.rmSync(cacheDir, { recursive: true, force: true });
+        logger_1.logger.info('Action cache cleared');
+    }
+}
+/**
+ * Resolve a `uses:` action reference to its current commit SHA, for the
+ * inventory and lockfile. Returns undefined if the ref can't be resolved
+ * (not an action reference, offline, or the lookup failed). Uses a token
+ * when one is available (githubToken), else anonymous `git ls-remote`.
+ */
+async function resolveActionSha(uses, options = {}) {
+    const ref = parseActionReference(uses);
+    if (!ref)
+        return undefined;
+    const timeoutMs = options.timeoutMs ?? DOWNLOAD_TIMEOUT_MS;
+    const token = options.token === undefined ? githubToken() : options.token;
+    const first = await resolveSha(ref, token, timeoutMs);
+    if (first.sha)
+        return first.sha;
+    // A rejected token shouldn't block resolution: retry anonymously.
+    if (first.unauthorized) {
+        return (await resolveSha(ref, null, timeoutMs)).sha;
+    }
+    return undefined;
+}
+//# sourceMappingURL=action-fetcher.js.map