@secureci/cli 0.5.0 → 0.6.0

package/dist/config.js

@@ -38,6 +38,7 @@ exports.getConfigFilePath = getConfigFilePath;
 exports.loadConfig = loadConfig;
 exports.saveConfig = saveConfig;
 exports.getDefaultContainerRuntime = getDefaultContainerRuntime;
+exports.getDefaultParallel = getDefaultParallel;
 exports.isValidConfigKey = isValidConfigKey;
 exports.getConfigValue = getConfigValue;
 exports.setConfigValue = setConfigValue;
@@ -47,6 +48,7 @@ exports.resolveNetworkDisabled = resolveNetworkDisabled;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const YAML = __importStar(require("yaml"));
+const scheduler_1 = require("./runner/scheduler");
 /** Built-in defaults, used when a key is absent from the config file. */
 exports.DEFAULT_CONFIG = {
     'container-runtime': 'docker'
@@ -100,12 +102,22 @@ function getDefaultContainerRuntime(config = loadConfig()) {
     }
     return value;
 }
+/** Resolve the effective `parallel`: config, else the CPU count. */
+function getDefaultParallel(config = loadConfig()) {
+    const value = config.parallel;
+    return value === undefined ? (0, scheduler_1.defaultParallelism)() : (0, scheduler_1.parseParallel)(value);
+}
 exports.CONFIG_KEYS = [
     'container-runtime',
     'container-image',
     'container-timeout',
     'container-memory',
-    'allow-network'
+    'allow-network',
+    'parallel',
+    'env-file',
+    'secret-file',
+    'input-file',
+    'var-file'
 ];
 /** `runner-images.<label>`: one entry of the runs-on -> image mapping. */
 const RUNNER_IMAGE_KEY = /^runner-images\.(.+)$/;
@@ -169,9 +181,19 @@ function parseConfigValue(key, rawValue) {
                 throw new Error(`Invalid value "${rawValue}" for allow-network. Must be "true" or "false".`);
             }
             return rawValue === 'true';
+        case 'parallel':
+            return (0, scheduler_1.parseParallel)(rawValue);
         case 'container-image':
         case 'container-memory':
             return rawValue;
+        case 'env-file':
+        case 'secret-file':
+        case 'input-file':
+        case 'var-file':
+            if (rawValue === '') {
+                throw new Error(`Invalid value "" for ${key}. Must be a file path.`);
+            }
+            return rawValue;
     }
 }
 /**

package/dist/init.js

@@ -7,7 +7,7 @@ exports.renderInitWorkflow = renderInitWorkflow;
  * the release tag matching this CLI's version.
  *
  * The output is deterministic for a given set of options, so it can be
- * regenerated and diffed. With uploads on (the default) the workflow asks for
+ * regenerated and diffed. With uploads on (the default) the job asks for
  * `security-events: write` and lets the action upload SARIF; with uploads off
  * it keeps `contents: read` only and passes `upload-sarif: false`.
  */
@@ -23,11 +23,18 @@ function renderInitWorkflow(options) {
         '  - pull_request',
         '',
         'permissions:',
-        '  contents: read'
+        '  contents: read',
+        '',
+        'jobs:',
+        '  secureci:',
+        '    runs-on: ubuntu-latest'
     ];
-    if (upload)
-        lines.push('  security-events: write');
-    lines.push('', 'jobs:', '  secureci:', '    runs-on: ubuntu-latest', '    steps:', '      - uses: actions/checkout@v4', `      - uses: secure-ci/cli@v${options.version}`);
+    // Write scopes belong on the job, not the workflow. Job-level permissions
+    // replace the top-level ones, so contents: read is repeated for checkout.
+    if (upload) {
+        lines.push('    permissions:', '      contents: read', '      security-events: write');
+    }
+    lines.push('    steps:', '      - uses: actions/checkout@v4', `      - uses: secure-ci/cli@v${options.version}`);
     const withLines = [];
     if (contract)
         withLines.push(`          contract: ${yamlScalar(contract)}`);

package/dist/inventory.js

@@ -247,6 +247,7 @@ async function addTransitive(direct, deps) {
             }
             byUses.set(dep.uses, dep);
             queue.push({ action: dep, depth: depth + 1 });
+            deps.onQueue?.(dep);
         }
     }
     return [...byUses.values()];

package/dist/parser/dangerous-triggers.js

@@ -0,0 +1,125 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.workflowTriggers = workflowTriggers;
+exports.dangerousTriggerErrors = dangerousTriggerErrors;
+exports.forbiddenTriggerErrors = forbiddenTriggerErrors;
+const RULE = 'secureci/dangerous-trigger';
+/**
+ * Triggers whose runs get the base repository's secrets and a read/write
+ * `GITHUB_TOKEN` even when the change came from a fork.
+ */
+const PRIVILEGED_TRIGGERS = ['pull_request_target', 'workflow_run'];
+/**
+ * Expressions (or literal refs) in `actions/checkout`'s `ref:` /
+ * `repository:` that select code the pull request's author controls,
+ * rather than the base branch.
+ */
+const UNTRUSTED_CHECKOUT = [
+    /github\.event\.pull_request\.head\.(sha|ref|repo\.full_name)\b/,
+    /github\.event\.pull_request\.merge_commit_sha\b/,
+    /github\.head_ref\b/,
+    /github\.event\.workflow_run\.head_(sha|branch|commit\.id|repository\.full_name)\b/,
+    /refs\/pull\//
+];
+/** A job `if:` that requires a maintainer-applied label to run. */
+const LABEL_GATE = /github\.event\.(pull_request\.labels|label\.name)\b/;
+/** The event names in `on:`, whichever form it takes (string, list or map). */
+function workflowTriggers(on) {
+    if (typeof on === 'string')
+        return [on];
+    if (Array.isArray(on)) {
+        return on.filter((t) => typeof t === 'string');
+    }
+    if (on && typeof on === 'object')
+        return Object.keys(on);
+    return [];
+}
+function isCheckout(step) {
+    return step.uses?.split('@')[0].toLowerCase() === 'actions/checkout';
+}
+/** `with.ref` / `with.repository` of a checkout that selects untrusted code. */
+function untrustedCheckoutInput(step) {
+    if (!isCheckout(step))
+        return undefined;
+    for (const key of ['ref', 'repository']) {
+        const value = step.with?.[key];
+        if (value === undefined)
+            continue;
+        if (UNTRUSTED_CHECKOUT.some((re) => re.test(String(value)))) {
+            return `${key}: ${String(value)}`;
+        }
+    }
+    return undefined;
+}
+/** How a step would execute checked-out code, or undefined if it doesn't. */
+function executes(step) {
+    if (step.run)
+        return 'run:';
+    if (step.uses?.startsWith('./'))
+        return `uses: ${step.uses}`;
+    return undefined;
+}
+/**
+ * "Pwn request" detection (#46): a workflow triggered by
+ * `pull_request_target` or `workflow_run` runs with secrets and a write
+ * token, so a job that checks out the pull request's code and then runs
+ * it (a `run:` step or a local `./` action, both of which use the checked
+ * out files) lets a fork execute code with those privileges.
+ *
+ * - error: such a job (reported once, at its untrusted checkout).
+ * - warning: the same job when its `if:` requires a label, since a
+ *   maintainer must then approve each run.
+ * - warning: a privileged trigger with no such job, once per trigger, so
+ *   teams can audit it. Omitted when a job-level finding is reported, so
+ *   a workflow is never reported twice for the same problem.
+ */
+function dangerousTriggerErrors(workflow) {
+    const triggers = workflowTriggers(workflow.on).filter((t) => PRIVILEGED_TRIGGERS.includes(t));
+    if (triggers.length === 0)
+        return [];
+    const named = triggers.map((t) => `"${t}"`).join(', ');
+    const findings = [];
+    for (const [jobId, job] of Object.entries(workflow.jobs ?? {})) {
+        const steps = job.steps ?? [];
+        const checkoutIdx = steps.findIndex((s) => untrustedCheckoutInput(s));
+        if (checkoutIdx === -1)
+            continue;
+        const runIdx = steps.findIndex((s, i) => i > checkoutIdx && executes(s) !== undefined);
+        if (runIdx === -1)
+            continue;
+        const gated = LABEL_GATE.test(String(job.if ?? ''));
+        findings.push({
+            path: `jobs.${jobId}.steps[${checkoutIdx}]`,
+            message: `Job "${jobId}" checks out untrusted code (${untrustedCheckoutInput(steps[checkoutIdx])}) ` +
+                `in a workflow triggered by ${named}, then executes it at steps[${runIdx}] (${executes(steps[runIdx])}). ` +
+                `These triggers run with the repository's secrets and a write token, so a fork can run its own code with them` +
+                (gated
+                    ? `. The job is gated by a label check in its if:, so review the pull request's code before applying the label`
+                    : `; check out the base ref instead, or move the build to an unprivileged pull_request workflow`),
+            severity: gated ? 'warning' : 'error',
+            rule: RULE
+        });
+    }
+    if (findings.length > 0)
+        return findings;
+    return triggers.map((trigger) => ({
+        path: `on.${trigger}`,
+        message: `Workflow is triggered by "${trigger}", which runs with the repository's secrets and a write token ` +
+            `even for ${trigger === 'workflow_run' ? 'runs started from a fork' : 'pull requests from forks'}; ` +
+            `make sure it never checks out or runs untrusted code`,
+        severity: 'warning',
+        rule: RULE
+    }));
+}
+/** Contract `forbidden-triggers`: one error per forbidden event in `on:`. */
+function forbiddenTriggerErrors(workflow, forbidden) {
+    return workflowTriggers(workflow.on)
+        .filter((t) => forbidden.includes(t))
+        .map((trigger) => ({
+        path: `on.${trigger}`,
+        message: `Trigger "${trigger}" is forbidden by the pipeline contract (forbidden-triggers)`,
+        severity: 'error',
+        rule: 'secureci/contract'
+    }));
+}
+//# sourceMappingURL=dangerous-triggers.js.map

package/dist/parser/injection.js

@@ -0,0 +1,281 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UNTRUSTED_CONTEXTS = void 0;
+exports.workflowInjectionErrors = workflowInjectionErrors;
+exports.actionInjectionErrors = actionInjectionErrors;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const expression_1 = require("../runner/expression");
+const repository_1 = require("../utils/repository");
+const workflow_parser_1 = require("./workflow-parser");
+/**
+ * Contexts an outside contributor can set to arbitrary text (`*` matches
+ * any key or array index). Based on GitHub Security Lab's list of untrusted
+ * input (https://securitylab.github.com/resources/github-actions-untrusted-input/),
+ * which GitHub's security hardening guide and zizmor's template-injection
+ * audit also use, plus discussion text, PR/issue label names and the
+ * fields of `workflow_run` that come from the triggering branch.
+ *
+ * Inputs of `workflow_dispatch` / `workflow_call` (and the matching
+ * `github.event.inputs.*`) are untrusted too, except typed ones that can't
+ * hold arbitrary text; those are derived from each workflow's triggers.
+ */
+exports.UNTRUSTED_CONTEXTS = [
+    'github.head_ref',
+    'github.event.issue.title',
+    'github.event.issue.body',
+    'github.event.issue.labels.*.name',
+    'github.event.pull_request.title',
+    'github.event.pull_request.body',
+    'github.event.pull_request.labels.*.name',
+    'github.event.pull_request.head.ref',
+    'github.event.pull_request.head.label',
+    'github.event.pull_request.head.repo.default_branch',
+    'github.event.comment.body',
+    'github.event.review.body',
+    'github.event.discussion.title',
+    'github.event.discussion.body',
+    'github.event.pages.*.page_name',
+    'github.event.commits.*.message',
+    'github.event.commits.*.author.email',
+    'github.event.commits.*.author.name',
+    'github.event.commits.*.committer.email',
+    'github.event.commits.*.committer.name',
+    'github.event.head_commit.message',
+    'github.event.head_commit.author.email',
+    'github.event.head_commit.author.name',
+    'github.event.head_commit.committer.email',
+    'github.event.head_commit.committer.name',
+    'github.event.workflow_run.display_title',
+    'github.event.workflow_run.head_branch',
+    'github.event.workflow_run.head_commit.message',
+    'github.event.workflow_run.head_commit.author.email',
+    'github.event.workflow_run.head_commit.author.name',
+    'github.event.workflow_run.pull_requests.*.head.ref'
+];
+const BASE_PATTERNS = exports.UNTRUSTED_CONTEXTS.map((c) => c.split('.'));
+/** Input types whose values are constrained, so can't carry a payload. */
+const SAFE_INPUT_TYPES = new Set([
+    'boolean',
+    'number',
+    'choice',
+    'environment'
+]);
+const GITHUB_SCRIPT = /^actions\/github-script(@|$)/i;
+const RULE = 'secureci/injection';
+/** The inner text of every `${{ }}` in a string, as the runner finds them. */
+function expressionsIn(text) {
+    return [...text.matchAll(/\$\{\{([\s\S]*?)\}\}/g)].map((m) => m[1].trim());
+}
+/** Whether `prefix` matches the leading segments of `full`. */
+function startsWith(full, prefix) {
+    return (prefix.length <= full.length &&
+        prefix.every((seg, i) => seg === '*' || full[i] === '*' || seg === full[i]));
+}
+/**
+ * The untrusted context paths that reach an expression's result: a value
+ * at or below an untrusted path, or (via toJSON) a whole subtree that holds
+ * one. An expression GitHub couldn't parse has none.
+ */
+function untrustedSources(expr, patterns) {
+    const flow = (0, expression_1.expressionDataFlow)(expr);
+    if (!flow)
+        return [];
+    const hits = [
+        ...flow.values.filter((v) => patterns.some((p) => startsWith(v, p))),
+        ...flow.trees.filter((t) => patterns.some((p) => startsWith(t, p) || startsWith(p, t)))
+    ];
+    return [...new Set(hits.map((h) => h.join('.')))];
+}
+function isUntrusted(text, patterns) {
+    return expressionsIn(String(text)).some((expr) => untrustedSources(expr, patterns).length > 0);
+}
+/** `inputs.<name>` / `github.event.inputs.<name>` of string-typed inputs. */
+function workflowInputPatterns(on) {
+    if (!on || typeof on !== 'object' || Array.isArray(on))
+        return [];
+    const names = new Set();
+    for (const trigger of ['workflow_dispatch', 'workflow_call']) {
+        const spec = on[trigger];
+        for (const [name, input] of Object.entries(spec?.inputs ?? {})) {
+            const type = String(input?.type ?? 'string').toLowerCase();
+            if (!SAFE_INPUT_TYPES.has(type))
+                names.add(name.toLowerCase());
+        }
+    }
+    return [...names].flatMap((name) => [
+        ['inputs', name],
+        ['github', 'event', 'inputs', name]
+    ]);
+}
+/**
+ * `inputs.<name>` of a composite action's inputs that its caller fills
+ * with untrusted input (or whose default is untrusted, when not given).
+ */
+function compositeInputPatterns(action, given, callerPatterns) {
+    const patterns = [];
+    for (const [name, input] of Object.entries(action.inputs ?? {})) {
+        // Input names are case-insensitive.
+        const passed = Object.entries(given ?? {}).find(([key]) => key.toLowerCase() === name.toLowerCase());
+        const untrusted = passed
+            ? isUntrusted(passed[1], callerPatterns)
+            : input?.default !== undefined &&
+                isUntrusted(input.default, BASE_PATTERNS);
+        if (untrusted)
+            patterns.push(['inputs', name.toLowerCase()]);
+    }
+    return patterns;
+}
+/** An environment variable name to suggest for a context path. */
+function envName(source) {
+    // The first segment is a context name, so some segment isn't `*`.
+    const segment = source
+        .split('.')
+        .filter((s) => s !== '*')
+        .pop();
+    return segment.toUpperCase().replace(/[^A-Z0-9_]/g, '_');
+}
+function finding(expr, sources, kind, at) {
+    const name = envName(sources[0]);
+    const target = kind === 'run'
+        ? 'the shell script, so a crafted value can run arbitrary commands'
+        : 'the github-script code, so a crafted value can run arbitrary code';
+    const use = kind === 'run' ? `"$${name}"` : `process.env.${name}`;
+    return {
+        path: at,
+        message: `\${{ ${expr} }} expands untrusted input (${sources.join(', ')}) into ${target}. Pass it through env: (e.g. env: ${name}: \${{ ${expr} }}) and use ${use} instead.`,
+        severity: 'error',
+        rule: RULE
+    };
+}
+function checkText(text, kind, at, patterns, scan) {
+    for (const expr of expressionsIn(String(text))) {
+        const sources = untrustedSources(expr, patterns);
+        if (sources.length > 0)
+            scan.errors.push(finding(expr, sources, kind, at));
+    }
+}
+/** Parse a file reached by recursion, or null if it can't be. */
+function tryParse(file) {
+    try {
+        return (0, workflow_parser_1.parseFile)(file);
+    }
+    catch {
+        // Not this check's concern: validating that file reports it.
+        return null;
+    }
+}
+/** The action.yml behind a local `uses: ./path`, if there is one. */
+function resolveLocalAction(uses, root) {
+    const target = path.resolve(root, uses);
+    return [
+        target,
+        path.join(target, 'action.yml'),
+        path.join(target, 'action.yaml')
+    ].find((f) => fs.existsSync(f) && fs.statSync(f).isFile());
+}
+const isLocal = (uses) => uses.startsWith('./') || uses.startsWith('../');
+function checkSteps(steps, at, patterns, stack, scan) {
+    steps.forEach((step, i) => {
+        const stepPath = `${at}steps[${i}]`;
+        if (step.run !== undefined) {
+            checkText(step.run, 'run', `${stepPath}.run`, patterns, scan);
+        }
+        if (!step.uses)
+            return;
+        if (GITHUB_SCRIPT.test(step.uses) && step.with?.script !== undefined) {
+            checkText(step.with.script, 'script', `${stepPath}.with.script`, patterns, scan);
+        }
+        if (!isLocal(step.uses))
+            return;
+        const file = resolveLocalAction(step.uses, scan.root);
+        if (!file || stack.includes(file))
+            return;
+        const parsed = tryParse(file);
+        if (parsed?.type !== 'action')
+            return;
+        checkSteps(parsed.file.runs.steps ?? [], `${stepPath} > ${step.uses} > `, [
+            ...BASE_PATTERNS,
+            ...compositeInputPatterns(parsed.file, step.with, patterns)
+        ], [...stack, file], scan);
+    });
+}
+function checkWorkflow(workflow, file, at, stack, scan) {
+    const patterns = [...BASE_PATTERNS, ...workflowInputPatterns(workflow.on)];
+    for (const [jobId, job] of Object.entries(workflow.jobs)) {
+        if (!job.uses) {
+            checkSteps(job.steps ?? [], `${at}jobs.${jobId}.`, patterns, stack, scan);
+            continue;
+        }
+        if (!isLocal(job.uses))
+            continue;
+        // A local reusable workflow resolves against its caller's repository.
+        const called = path.resolve((0, repository_1.repositoryRoot)(file), job.uses);
+        if (stack.includes(called) || !fs.existsSync(called))
+            continue;
+        const parsed = tryParse(called);
+        if (parsed?.type !== 'workflow')
+            continue;
+        checkWorkflow(parsed.file, called, `${at}jobs.${jobId} > ${job.uses} > `, [...stack, called], scan);
+    }
+}
+/**
+ * Template injection in a workflow: an untrusted `${{ }}` expression (see
+ * UNTRUSTED_CONTEXTS) in a `run:` script or `actions/github-script`'s
+ * `with.script`. GitHub substitutes expressions into the script text before
+ * it runs, so such a value becomes code. `env:` values are not checked:
+ * passing data through the environment is the fix. Local composite
+ * actions and local reusable workflows are checked recursively.
+ */
+function workflowInjectionErrors(workflow, workflowPath) {
+    const file = path.resolve(workflowPath);
+    const scan = { root: (0, repository_1.repositoryRoot)(file), errors: [] };
+    checkWorkflow(workflow, file, '', [file], scan);
+    return scan.errors;
+}
+/**
+ * Template injection in a composite action's steps (see
+ * workflowInjectionErrors). Its own inputs aren't treated as untrusted
+ * here, since the callers are unknown; a workflow that passes untrusted
+ * input to a local action is checked through that call.
+ */
+function actionInjectionErrors(action, actionPath) {
+    const file = path.resolve(actionPath);
+    const scan = { root: (0, repository_1.repositoryRoot)(file), errors: [] };
+    checkSteps(action.runs?.steps ?? [], 'runs.', BASE_PATTERNS, [file], scan);
+    return scan.errors;
+}
+//# sourceMappingURL=injection.js.map

package/dist/parser/permissions.js

@@ -0,0 +1,145 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GITHUB_TOKEN_SCOPES = void 0;
+exports.workflowPermissionErrors = workflowPermissionErrors;
+exports.contractPermissionErrors = contractPermissionErrors;
+/** SARIF rule for every GITHUB_TOKEN permissions finding. */
+const RULE = 'secureci/permissions';
+/**
+ * Scopes `permissions:` accepts, per GitHub's workflow syntax.
+ * `repository-projects` is kept for older workflows (classic Projects).
+ */
+exports.GITHUB_TOKEN_SCOPES = [
+    'actions',
+    'artifact-metadata',
+    'attestations',
+    'checks',
+    'contents',
+    'deployments',
+    'discussions',
+    'id-token',
+    'issues',
+    'models',
+    'packages',
+    'pages',
+    'pull-requests',
+    'repository-projects',
+    'security-events',
+    'statuses'
+];
+const RANK = { none: 0, read: 1, write: 2 };
+const hasOwn = (object, key) => Object.prototype.hasOwnProperty.call(object, key);
+/** Rank of a level, or undefined for anything that isn't one. */
+const rankOf = (level) => typeof level === 'string' && hasOwn(RANK, level)
+    ? RANK[level]
+    : undefined;
+const declared = (permissions) => permissions !== undefined && permissions !== null;
+const isScopeMap = (permissions) => typeof permissions === 'object' &&
+    permissions !== null &&
+    !Array.isArray(permissions);
+/**
+ * A reusable workflow runs with its caller's token, so a workflow whose only
+ * trigger is `workflow_call` doesn't need its own top-level block.
+ */
+function onlyWorkflowCall(on) {
+    const events = typeof on === 'string'
+        ? [on]
+        : Array.isArray(on)
+            ? on
+            : on && typeof on === 'object'
+                ? Object.keys(on)
+                : [];
+    return events.length > 0 && events.every((e) => e === 'workflow_call');
+}
+/**
+ * Jobs whose token falls back to the repository/organization default:
+ * no top-level `permissions:` and none on the job. Empty when the workflow
+ * declares a top-level block or only runs as a reusable workflow.
+ */
+function uncoveredJobs(workflow) {
+    if (declared(workflow.permissions) || onlyWorkflowCall(workflow.on)) {
+        return [];
+    }
+    return Object.entries(workflow.jobs ?? {})
+        .filter(([, job]) => !declared(job?.permissions))
+        .map(([id]) => id);
+}
+const quoteList = (ids) => ids.map((id) => `"${id}"`).join(', ');
+const finding = (path, message, severity) => ({ path, message, severity, rule: RULE });
+/**
+ * Default GITHUB_TOKEN checks (warnings, so existing workflows keep
+ * validating): jobs left on the default token, `write-all` at either level,
+ * and write scopes granted to every job at the workflow level.
+ */
+function workflowPermissionErrors(workflow) {
+    const errors = [];
+    const uncovered = uncoveredJobs(workflow);
+    if (uncovered.length > 0) {
+        errors.push(finding('permissions', `No top-level permissions: and job(s) ${quoteList(uncovered)} declare none, so their GITHUB_TOKEN gets the repository's default permissions (read/write on every scope in many repositories). Add a top-level block such as "permissions: { contents: read }", or declare permissions on each job`, 'warning'));
+    }
+    const top = workflow.permissions;
+    if (top === 'write-all') {
+        errors.push(finding('permissions', 'permissions: write-all gives every job write access to every scope. Keep the top level read-only (e.g. "contents: read") and grant write scopes on the jobs that need them', 'warning'));
+    }
+    else if (isScopeMap(top)) {
+        for (const [scope, level] of Object.entries(top)) {
+            if (level !== 'write')
+                continue;
+            errors.push(finding(`permissions.${scope}`, `Workflow-level "${scope}: write" applies to every job. Declare it on the job(s) that need it instead (job-level permissions replace the top-level ones)`, 'warning'));
+        }
+    }
+    for (const [jobId, job] of Object.entries(workflow.jobs ?? {})) {
+        if (job?.permissions === 'write-all') {
+            errors.push(finding(`jobs.${jobId}.permissions`, `Job "${jobId}" uses permissions: write-all, giving its GITHUB_TOKEN write access to every scope. List only the scopes it needs`, 'warning'));
+        }
+    }
+    return errors;
+}
+/**
+ * Contract `permissions:` policy (errors). `required`: every job must have
+ * declared permissions, top-level or its own. `max`: a ceiling on the
+ * top-level block (unlisted scopes are capped at `none`); job-level
+ * permissions aren't capped, so write scopes go per job. A workflow whose
+ * only trigger is `workflow_call` needs no top-level block for either.
+ */
+function contractPermissionErrors(workflow, policy) {
+    const uncovered = uncoveredJobs(workflow);
+    const max = policy.max;
+    if (uncovered.length > 0 && (policy.required || max)) {
+        return [
+            finding('permissions', policy.required
+                ? `The contract requires declared GITHUB_TOKEN permissions, but the workflow has no top-level permissions: and job(s) ${quoteList(uncovered)} declare none. Add a top-level permissions: block, or declare permissions on each job`
+                : `The contract caps workflow-level permissions at (${formatCeiling(max)}), but the workflow has no top-level permissions:, so job(s) ${quoteList(uncovered)} get the repository's default token permissions. Add a top-level block within the cap, or declare permissions on each job`, 'error')
+        ];
+    }
+    if (!max)
+        return [];
+    const ceiling = (scope) => (hasOwn(max, scope) ? rankOf(max[scope]) : undefined) ?? RANK.none;
+    const top = workflow.permissions;
+    if (top === 'read-all' || top === 'write-all') {
+        const needed = top === 'read-all' ? RANK.read : RANK.write;
+        if (exports.GITHUB_TOKEN_SCOPES.some((scope) => ceiling(scope) < needed)) {
+            return [
+                finding('permissions', `Workflow-level "${top}" exceeds the contract's cap on workflow-level permissions (${formatCeiling(max)}). List only the scopes the cap allows, and grant the rest on the jobs that need them`, 'error')
+            ];
+        }
+        return [];
+    }
+    const errors = [];
+    if (isScopeMap(top)) {
+        for (const [scope, level] of Object.entries(top)) {
+            const rank = rankOf(level);
+            if (rank !== undefined && rank > ceiling(scope)) {
+                errors.push(finding(`permissions.${scope}`, `Workflow-level "${scope}: ${level}" exceeds the contract's cap on workflow-level permissions (${formatCeiling(max)}). Grant it on the job(s) that need it instead`, 'error'));
+            }
+        }
+    }
+    return errors;
+}
+function formatCeiling(max) {
+    const entries = Object.entries(max);
+    return entries.length === 0
+        ? 'none'
+        : entries.map(([scope, level]) => `${scope}: ${level}`).join(', ');
+}
+//# sourceMappingURL=permissions.js.map