@secureci/cli 0.5.1 → 0.7.0

package/dist/pin.js

@@ -0,0 +1,311 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findUsesSites = findUsesSites;
+exports.isPinAllowed = isPinAllowed;
+exports.pinContent = pinContent;
+exports.localPinTargets = localPinTargets;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const YAML = __importStar(require("yaml"));
+const repository_1 = require("./utils/repository");
+const FULL_SHA = /^[0-9a-f]{40}$/i;
+/**
+ * Every `uses:` a runner reads: `jobs.<id>.uses` (reusable workflows),
+ * `jobs.<id>.steps[*].uses` and a composite action's `runs.steps[*].uses`.
+ * Read from the YAML syntax tree, so `uses:` inside a script or an input
+ * isn't mistaken for one, with source offsets for in-place edits.
+ */
+function findUsesSites(content) {
+    const doc = parseYaml(content);
+    const root = doc.contents;
+    if (!YAML.isMap(root))
+        return [];
+    const nodes = [];
+    const usesOf = (node) => {
+        if (!YAML.isMap(node))
+            return;
+        const uses = node.get('uses', true);
+        if (YAML.isScalar(uses))
+            nodes.push(uses);
+    };
+    const stepsOf = (node) => {
+        if (!YAML.isMap(node))
+            return;
+        const steps = node.get('steps', true);
+        if (YAML.isSeq(steps))
+            steps.items.forEach(usesOf);
+    };
+    const jobs = root.get('jobs', true);
+    if (YAML.isMap(jobs)) {
+        for (const pair of jobs.items) {
+            usesOf(pair.value);
+            stepsOf(pair.value);
+        }
+    }
+    stepsOf(root.get('runs', true));
+    return nodes
+        .filter((node) => node.range && typeof node.value === 'string')
+        .map((node) => {
+        const [start, end] = node.range;
+        return {
+            line: content.slice(0, start).split('\n').length,
+            uses: node.value,
+            start,
+            end,
+            style: scalarStyle(node.type)
+        };
+    })
+        .sort((a, b) => a.start - b.start);
+}
+function parseYaml(content) {
+    const doc = YAML.parseDocument(content);
+    if (doc.errors.length > 0) {
+        throw new Error(`File is not valid YAML: ${doc.errors[0].message}`);
+    }
+    return doc;
+}
+function scalarStyle(type) {
+    if (type === 'QUOTE_SINGLE')
+        return 'single';
+    if (type === 'QUOTE_DOUBLE')
+        return 'double';
+    if (type === 'BLOCK_LITERAL' || type === 'BLOCK_FOLDED')
+        return 'block';
+    return 'plain';
+}
+/**
+ * Whether a contract's `pins.allow` exempts a reference from pinning: an
+ * owner, or the exact action name, case-insensitively for owner and repo.
+ * This mirrors the contract's own pins check, so `pin` never leaves a
+ * reference on a tag that `validate --contract` would then reject.
+ */
+function isPinAllowed(uses, allow) {
+    const at = uses.lastIndexOf('@');
+    const name = normalizeName(at === -1 ? uses : uses.slice(0, at));
+    const owner = name.split('/')[0];
+    const allowed = new Set(allow.map(normalizeName));
+    return allowed.has(name) || allowed.has(owner);
+}
+function normalizeName(name) {
+    const parts = name.split('/');
+    return [
+        ...parts.slice(0, 2).map((p) => p.toLowerCase()),
+        ...parts.slice(2)
+    ].join('/');
+}
+/**
+ * Pin every remote `uses:` reference in a workflow or action file to the
+ * commit SHA `resolve` returns, keeping the tag in a trailing comment
+ * (`owner/repo@<sha> # v4`) so Dependabot and Renovate can still update
+ * it. The text is edited in place (only the value and its comment change),
+ * never re-serialised, so formatting and other comments survive.
+ *
+ * Left alone: local (`./`) and `docker://` references, references already
+ * pinned to a full SHA, and those `allow` exempts. A reference that can't
+ * be resolved is reported in `unresolved` and not changed.
+ */
+async function pinContent(content, resolve, options = {}) {
+    const sites = findUsesSites(content);
+    const result = {
+        content,
+        changes: [],
+        unresolved: [],
+        allowed: []
+    };
+    const lineCounts = new Map();
+    sites.forEach((s) => lineCounts.set(s.line, (lineCounts.get(s.line) ?? 0) + 1));
+    const resolved = new Map();
+    const edits = [];
+    for (const site of sites) {
+        const { uses, line } = site;
+        if (/^(\.\.?\/|docker:\/\/)/.test(uses))
+            continue;
+        const at = uses.lastIndexOf('@');
+        const name = at === -1 ? '' : uses.slice(0, at);
+        const ref = uses.slice(at + 1);
+        const parts = name.split('/');
+        if (at === -1 || !ref || parts.length < 2 || parts.some((p) => !p)) {
+            result.unresolved.push({
+                line,
+                uses,
+                reason: 'is not an owner/repo@ref reference'
+            });
+            continue;
+        }
+        if (FULL_SHA.test(ref))
+            continue;
+        if (isPinAllowed(uses, options.allow ?? [])) {
+            result.allowed.push({ line, uses });
+            continue;
+        }
+        if (site.style === 'block') {
+            result.unresolved.push({
+                line,
+                uses,
+                reason: 'is written as a block scalar; pin it by hand'
+            });
+            continue;
+        }
+        if (!resolved.has(uses))
+            resolved.set(uses, resolve(uses));
+        const sha = (await resolved.get(uses))?.toLowerCase();
+        if (!sha || !FULL_SHA.test(sha)) {
+            result.unresolved.push({
+                line,
+                uses,
+                reason: 'could not be resolved to a commit'
+            });
+            continue;
+        }
+        const pinned = `${name}@${sha}`;
+        const quote = site.style === 'single' ? "'" : site.style === 'double' ? '"' : '';
+        edits.push({
+            start: site.start,
+            end: site.end,
+            text: `${quote}${pinned}${quote}`
+        });
+        // Several references on one line (a flow sequence) can't each have a
+        // trailing comment, so none is written rather than a wrong one.
+        if (lineCounts.get(line) === 1) {
+            edits.push(commentEdit(content, site.end, ref));
+        }
+        result.changes.push({ line, uses, ref, sha, pinned });
+    }
+    result.content = edits
+        .sort((a, b) => b.start - a.start)
+        .reduce((text, e) => text.slice(0, e.start) + e.text + text.slice(e.end), content);
+    return result;
+}
+/**
+ * The edit that leaves `# <ref>` as the comment of the line a value ends
+ * on: an old version comment is replaced, any other comment kept after
+ * the ref, and with no comment one is added at the end of the line.
+ */
+function commentEdit(content, valueEnd, ref) {
+    let lineEnd = content.indexOf('\n', valueEnd);
+    if (lineEnd === -1)
+        lineEnd = content.length;
+    if (content[lineEnd - 1] === '\r')
+        lineEnd--;
+    const tail = content.slice(valueEnd, lineEnd);
+    const hash = commentStart(tail);
+    if (hash === -1) {
+        const at = valueEnd + tail.trimEnd().length;
+        return { start: at, end: at, text: ` # ${ref}` };
+    }
+    const body = tail.slice(hash + 1).trim();
+    return {
+        start: valueEnd + hash,
+        end: lineEnd,
+        text: `# ${ref}${commentRest(body, ref)}`
+    };
+}
+/** Where a YAML comment starts in the rest of a line, or -1. */
+function commentStart(tail) {
+    let quote;
+    for (let i = 0; i < tail.length; i++) {
+        const c = tail[i];
+        if (quote) {
+            if (c === '\\' && quote === '"')
+                i++;
+            else if (c === quote)
+                quote = undefined;
+        }
+        else if (c === "'" || c === '"') {
+            quote = c;
+        }
+        else if (c === '#' && i > 0 && /\s/.test(tail[i - 1])) {
+            return i;
+        }
+    }
+    return -1;
+}
+/**
+ * What to keep of an existing comment after the new `# <ref>`: the text
+ * after an old version (`v3`, `3.2.1`, `tag=v3`, `pin @v3`, or the old
+ * ref itself), else the whole comment.
+ */
+function commentRest(body, ref) {
+    if (!body)
+        return '';
+    const version = body.match(/^(?:tag\s*=\s*|pin\s*@?\s*)?@?v?\d[\w.+-]*(.*)$/i);
+    const rest = version
+        ? version[1]
+        : body === ref || body.startsWith(`${ref} `)
+            ? body.slice(ref.length)
+            : undefined;
+    if (rest === undefined)
+        return ` - ${body}`;
+    return rest.trim() ? ` ${rest.trim()}` : '';
+}
+/**
+ * The given files plus the local composite actions (`./path`) and local
+ * reusable workflows they use, recursively, so a whole repository is
+ * pinned in one go. `./` resolves against the repository root, as on
+ * GitHub. Files are listed once; one that can't be read is kept (for the
+ * caller to report) but not followed.
+ */
+function localPinTargets(files) {
+    const seen = new Set(files.map((f) => path.resolve(f)));
+    const result = [...files];
+    const follow = (file, root) => {
+        let sites;
+        try {
+            sites = findUsesSites(fs.readFileSync(file, 'utf8'));
+        }
+        catch {
+            return;
+        }
+        for (const { uses } of sites) {
+            if (!uses.startsWith('./') && !uses.startsWith('../'))
+                continue;
+            const target = path.resolve(root, uses);
+            const local = [
+                target,
+                ...['action.yml', 'action.yaml'].map((n) => path.join(target, n))
+            ].find((c) => fs.existsSync(c) && fs.statSync(c).isFile());
+            if (!local || seen.has(local))
+                continue;
+            seen.add(local);
+            result.push(local);
+            follow(local, root);
+        }
+    };
+    for (const file of files)
+        follow(file, (0, repository_1.repositoryRoot)(file));
+    return result;
+}
+//# sourceMappingURL=pin.js.map

package/dist/report.js

@@ -4,6 +4,8 @@ exports.formatReport = formatReport;
 exports.formatValidation = formatValidation;
 /** A SARIF rule id per error, so code-scanning can group findings. */
 function ruleIdFor(error) {
+    if (error.rule)
+        return error.rule;
     if (/^required\[|^forbidden\[/.test(error.path))
         return 'secureci/contract';
     if (/\.if$|\bif:/.test(error.path))
@@ -13,7 +15,11 @@ function ruleIdFor(error) {
 const RULES = {
     'secureci/validation': 'Workflow or action structure',
     'secureci/contract': 'Pipeline contract',
-    'secureci/expression': 'Expression / if: condition'
+    'secureci/expression': 'Expression / if: condition',
+    'secureci/injection': 'Untrusted input in a shell or script',
+    'secureci/permissions': 'GITHUB_TOKEN permissions',
+    'secureci/dangerous-trigger': 'Privileged trigger with untrusted code',
+    'secureci/vulnerable-action': 'Action with a known security advisory'
 };
 function jsonForFile(entry) {
     return {
@@ -22,7 +28,8 @@ function jsonForFile(entry) {
         errors: entry.result.errors.map((e) => ({
             path: e.path,
             message: e.message,
-            severity: e.severity
+            severity: e.severity,
+            rule: ruleIdFor(e)
         }))
     };
 }

package/dist/runner/action-fetcher.js

@@ -37,10 +37,16 @@ exports.parseActionReference = parseActionReference;
 exports.getActionCacheDir = getActionCacheDir;
 exports.githubToken = githubToken;
 exports._resetGithubTokenForTests = _resetGithubTokenForTests;
+exports.serverUrl = serverUrl;
+exports.apiUrl = apiUrl;
 exports.lsRemoteSha = lsRemoteSha;
+exports.parseLsRemoteTags = parseLsRemoteTags;
+exports.lsRemoteTags = lsRemoteTags;
+exports.getText = getText;
 exports.fetchAction = fetchAction;
 exports.fetchRepoFile = fetchRepoFile;
 exports.clearActionCache = clearActionCache;
+exports.cachedActionSha = cachedActionSha;
 exports.resolveActionSha = resolveActionSha;
 exports.resolveRepoIdentity = resolveRepoIdentity;
 exports.lsRemoteReachable = lsRemoteReachable;
@@ -110,9 +116,14 @@ function githubToken() {
 function _resetGithubTokenForTests() {
     discoveredToken = undefined;
 }
+/** The GitHub server ($GITHUB_SERVER_URL, default https://github.com). */
 function serverUrl() {
     return (process.env.GITHUB_SERVER_URL || 'https://github.com').replace(/\/+$/, '');
 }
+/**
+ * The GitHub REST API base: $GITHUB_API_URL, else api.github.com, or
+ * `<server>/api/v3` for GitHub Enterprise Server.
+ */
 function apiUrl() {
     if (process.env.GITHUB_API_URL) {
         return process.env.GITHUB_API_URL.replace(/\/+$/, '');
@@ -155,7 +166,51 @@ async function lsRemoteSha(url, ref) {
         refs.get(`refs/tags/${ref}`) ??
         refs.get(`refs/heads/${ref}`));
 }
-/** GET a small text response (the API commit lookup). */
+/**
+ * Tag name -> commit SHA from `git ls-remote --tags` output. An annotated
+ * tag's peeled entry (`refs/tags/x^{}`) wins, so every SHA is a commit.
+ */
+function parseLsRemoteTags(output) {
+    const tags = new Map();
+    const peeled = new Set();
+    for (const line of output.split('\n')) {
+        const [sha, ref] = line.trim().split(/\s+/);
+        if (!sha || !FULL_SHA.test(sha) || !ref?.startsWith('refs/tags/'))
+            continue;
+        let name = ref.slice('refs/tags/'.length);
+        const isPeeled = name.endsWith('^{}');
+        if (isPeeled)
+            name = name.slice(0, -3);
+        if (isPeeled || !peeled.has(name))
+            tags.set(name, sha.toLowerCase());
+        if (isPeeled)
+            peeled.add(name);
+    }
+    return tags;
+}
+/**
+ * Every tag of the repository at `url` and the commit it points at, via
+ * anonymous `git ls-remote --tags` (no API rate limit), or undefined if
+ * the repository can't be read.
+ */
+async function lsRemoteTags(url) {
+    try {
+        const { stdout } = await execFileAsync('git', ['ls-remote', '--tags', url], {
+            encoding: 'utf8',
+            timeout: 15000,
+            maxBuffer: 16 * 1024 * 1024,
+            env: { ...process.env, GIT_TERMINAL_PROMPT: '0' }
+        });
+        return parseLsRemoteTags(stdout);
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * GET a small text response (API lookups). Rejects on a non-200 status
+ * with an error carrying `status`.
+ */
 function getText(url, headers, timeoutMs) {
     return new Promise((resolve, reject) => {
         const client = url.startsWith('http://') ? http : https;
@@ -278,7 +333,27 @@ function writeRefIndex(dir, refs) {
  * picked up. If the ref can't be resolved (offline, rate-limited), the
  * last commit cached for it is used. Returns the repository root.
  */
-async function fetchRepository(ref, uses, options) {
+const inflight = new Map();
+/**
+ * fetchRepositoryOnce, shared by concurrent callers asking for the same
+ * repository and ref (jobs running in parallel), so it is downloaded and
+ * written into the cache once.
+ */
+function fetchRepository(ref, uses, options) {
+    const key = JSON.stringify([
+        repoCacheDir(ref),
+        ref.ref,
+        !!options.offline,
+        options.token === undefined ? 'discovered' : options.token
+    ]);
+    let pending = inflight.get(key);
+    if (!pending) {
+        pending = fetchRepositoryOnce(ref, uses, options).finally(() => inflight.delete(key));
+        inflight.set(key, pending);
+    }
+    return pending;
+}
+async function fetchRepositoryOnce(ref, uses, options) {
     const dir = repoCacheDir(ref);
     const refs = readRefIndex(dir);
     const cachedSha = FULL_SHA.test(ref.ref)
@@ -334,8 +409,12 @@ async function fetchRepository(ref, uses, options) {
         const [top] = fs.readdirSync(extractDir);
         if (!top)
             throw new Error('No files extracted from tarball');
-        fs.rmSync(target, { recursive: true, force: true });
-        fs.renameSync(path.join(extractDir, top), target);
+        // A commit's content never changes: keep a copy another job (asking
+        // by another ref) put there meanwhile, as it may be in use.
+        if (!sha || !fs.existsSync(target)) {
+            fs.rmSync(target, { recursive: true, force: true });
+            fs.renameSync(path.join(extractDir, top), target);
+        }
         if (sha) {
             writeRefIndex(dir, { ...readRefIndex(dir), [ref.ref]: sha });
         }
@@ -410,6 +489,23 @@ function clearActionCache() {
         logger_1.logger.info('Action cache cleared');
     }
 }
+/**
+ * The commit a ref resolved to when it was last downloaded into the action
+ * cache, without touching the network (for offline use), or undefined when
+ * that commit isn't cached. An already-pinned SHA is returned as is. For a
+ * moving ref (`@main`) this is the last commit seen, not necessarily the
+ * current one.
+ */
+function cachedActionSha(uses) {
+    const ref = parseActionReference(uses);
+    if (!ref)
+        return undefined;
+    if (FULL_SHA.test(ref.ref))
+        return ref.ref.toLowerCase();
+    const dir = repoCacheDir(ref);
+    const sha = readRefIndex(dir)[ref.ref];
+    return sha && fs.existsSync(path.join(dir, sha)) ? sha : undefined;
+}
 /**
  * Resolve a `uses:` action reference to its current commit SHA, for the
  * inventory and lockfile. Returns undefined if the ref can't be resolved

package/dist/runner/builtin-actions.js

@@ -435,14 +435,24 @@ async function saveCache(fsys, scope, key, paths) {
             warning: 'Path Validation Error: Path(s) specified in the action for caching do(es) not exist, hence no cache is being saved.'
         };
     }
-    const staging = `${dir}.tmp-${process.pid}`;
-    fs.rmSync(staging, { recursive: true, force: true });
+    // Unique per save: jobs running at once may save the same key.
+    const staging = `${dir}.tmp-${process.pid}-${crypto.randomBytes(4).toString('hex')}`;
     for (const file of files) {
         copyFile(file.host, path.join(staging, 'files', ...cachedLocation(fsys, file.logical).split('/')));
     }
     fs.writeFileSync(path.join(staging, 'meta.json'), JSON.stringify({ key, version, created: Date.now() }));
     fs.mkdirSync(path.dirname(dir), { recursive: true });
-    fs.renameSync(staging, dir);
+    try {
+        fs.renameSync(staging, dir);
+    }
+    catch (error) {
+        fs.rmSync(staging, { recursive: true, force: true });
+        // Another job saved this key meanwhile; cache entries are immutable.
+        if (fs.existsSync(path.join(dir, 'meta.json'))) {
+            return ok(`Cache for key "${key}" already exists; not saving`);
+        }
+        throw error;
+    }
     return ok(`Cache saved with key: ${key} (${files.length} file(s))`);
 }
 /** `actions/cache`, `actions/cache/restore` and `actions/cache/save`. */

package/dist/runner/dry-run.js

@@ -4,11 +4,15 @@ exports.dryRun = dryRun;
 const workflow_parser_1 = require("../parser/workflow-parser");
 const logger_1 = require("../utils/logger");
 const validator_1 = require("../parser/validator");
+const expression_1 = require("./expression");
+const job_plan_1 = require("./job-plan");
+// A matrix expression reading a context a dry run doesn't have.
+const RUN_TIME_MATRIX = /\$\{\{[^}]*\b(?:needs|inputs|vars|github|secrets)\b/;
 /**
  * Perform a dry run of a workflow or action file
  * Shows what would be executed without actually running anything
  */
-function dryRun(filePath) {
+function dryRun(filePath, options = {}) {
     try {
         const parsed = (0, workflow_parser_1.parseFile)(filePath);
         // A file a real run would reject fails the dry run too.
@@ -23,7 +27,7 @@ function dryRun(filePath) {
             return { success: false, type: parsed.type };
         }
         if (parsed.type === 'workflow') {
-            return dryRunWorkflow(parsed);
+            return dryRunWorkflow(parsed, options);
         }
         else {
             return dryRunAction(parsed);
@@ -37,22 +41,56 @@ function dryRun(filePath) {
         };
     }
 }
-function dryRunWorkflow(parsed) {
+function dryRunWorkflow(parsed, options) {
     const workflow = parsed.file;
+    const filter = options.matrix ?? {};
+    const definedKeys = new Set();
+    let runTimeMatrix = false;
+    let unmatched = false;
     logger_1.logger.info(`Workflow: ${workflow.name}`);
     logger_1.logger.info(`Trigger: ${JSON.stringify(workflow.on)}`);
-    const jobs = Object.entries(workflow.jobs).map(([jobId, job]) => {
+    const selectedJobs = Object.entries(workflow.jobs).filter(([jobId]) => !options.job || jobId === options.job);
+    const jobs = selectedJobs.flatMap(([jobId, job]) => {
+        // Matrix combinations, as far as they can be known without running.
+        let matrix;
+        const rawMatrix = job.strategy?.matrix;
+        const atRunTime = rawMatrix !== undefined &&
+            RUN_TIME_MATRIX.test(JSON.stringify(rawMatrix));
+        if (atRunTime) {
+            runTimeMatrix = true;
+        }
+        else if (rawMatrix !== undefined) {
+            const combinations = (0, job_plan_1.expandMatrix)(rawMatrix, (0, expression_1.createContext)());
+            combinations.forEach((c) => Object.keys(c).forEach((k) => definedKeys.add(k)));
+            const { keys, matches } = (0, job_plan_1.filterMatrix)(combinations, filter);
+            if (keys.length > 0 && matches.length === 0) {
+                logger_1.logger.warn((0, job_plan_1.noMatrixMatchMessage)(jobId, filter, combinations));
+                unmatched = true;
+                return [];
+            }
+            matrix = matches.map((m) => (0, job_plan_1.matrixLabel)(m.values));
+        }
         logger_1.logger.step(`Job: ${jobId} (${job.name || jobId})`);
+        if (atRunTime) {
+            logger_1.logger.info('  Matrix: resolved at run time');
+        }
+        else if (matrix) {
+            logger_1.logger.info(`  Matrix (${matrix.length} combination(s)):`);
+            matrix.forEach((label) => logger_1.logger.info(`    ${label}`));
+        }
         // Handle reusable workflow calls
         if (job.uses) {
             logger_1.logger.info(`  Uses workflow: ${job.uses}`);
             if (job.with) {
                 logger_1.logger.info(`  With inputs: ${JSON.stringify(job.with)}`);
             }
-            return {
-                name: jobId,
-                steps: [`Calls reusable workflow: ${job.uses}`]
-            };
+            return [
+                {
+                    name: jobId,
+                    steps: [`Calls reusable workflow: ${job.uses}`],
+                    ...(matrix ? { matrix } : {})
+                }
+            ];
         }
         // Handle regular jobs
         if (job['runs-on']) {
@@ -74,11 +112,18 @@ function dryRunWorkflow(parsed) {
             logger_1.logger.info(stepDesc);
             return stepDesc;
         });
-        return {
-            name: jobId,
-            steps
-        };
+        return [{ name: jobId, steps, ...(matrix ? { matrix } : {}) }];
     });
+    // A key might belong to a matrix only known at run time.
+    if (!runTimeMatrix) {
+        for (const key of (0, job_plan_1.unknownMatrixKeys)(filter, definedKeys)) {
+            logger_1.logger.warn(`--matrix ${key}: no matrix job defines this key; it was ignored`);
+        }
+    }
+    if (unmatched) {
+        logger_1.logger.error('Dry run failed: a --matrix filter matched no combination');
+        return { success: false, type: 'workflow', jobs };
+    }
     logger_1.logger.success('Dry run completed successfully');
     return {
         success: true,