@secureci/cli 0.6.0 → 0.8.0

package/README.md

@@ -16,14 +16,16 @@ of [SecureCI](https://secure-ci.dev).
 
 A single CLI that understands GitHub Actions the way the runner does:
 
-- **Run workflows locally** — jobs in `needs:` order, matrix builds, reusable
-  workflows, composite / JavaScript / Docker actions, and the full
+- **Run workflows locally** — jobs in `needs:` order (independent jobs and
+  matrix combinations in parallel), matrix builds, reusable workflows, composite / JavaScript / Docker actions, and the full
   `${{ }}` / `if:` expression language.
 - **Validate** workflow and action files, flag **template injection**
-  (untrusted `${{ }}` input expanded into `run:` scripts) and over-broad
-  `GITHUB_TOKEN` permissions, and **check them against a pipeline contract**
-  (required/forbidden actions, ordering, minimum versions, SHA-pinning and
-  permissions rules).
+  (untrusted `${{ }}` input expanded into `run:` scripts), over-broad
+  `GITHUB_TOKEN` permissions and `pull_request_target` / `workflow_run` jobs
+  that run untrusted code (noting whether `actions/checkout`'s safe default
+  covers the checkout), and **check them against a pipeline contract**
+  (required/forbidden actions, ordering, minimum versions, SHA-pinning,
+  permissions, forbidden triggers and advisory severity rules).
 - **Inventory** every action a workflow pulls in, resolve each tag to a commit
   SHA, and **catch supply-chain drift** when a tag quietly starts pointing
   somewhere new.
@@ -235,9 +237,9 @@ the feature named, and none runs at install time.
 | Capability               | Where                                                                  | Why                                                                                                                                                                                       |
 | ------------------------ | ---------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | Shell / process spawning | `run:` steps, JavaScript actions, `docker`/`podman`/`nerdctl`          | Runs workflow steps in a container (or on your host with `--container-runtime host`). `commander` also loads `child_process`, used only for executable subcommands this CLI does not use. |
-| Network                  | `github.com`, `api.github.com` (or the GHES host you set)              | Downloads actions and workflows, and resolves tags to commit SHAs.                                                                                                                        |
+| Network                  | `github.com`, `api.github.com` (or the GHES host you set)              | Downloads actions and workflows, resolves tags to commit SHAs, and looks up security advisories for the actions you use (skipped with `--offline`).                                       |
 | Environment variables    | `HOME`, `PATH`, `GITHUB_*`, `GITHUB_TOKEN`, `GH_TOKEN`                 | Builds the runner environment and authenticates GitHub downloads.                                                                                                                         |
-| Filesystem               | `~/.secureci/`, the working directory, temp dirs                       | Caches actions, stores artifacts and config, and reads your workflow files.                                                                                                               |
+| Filesystem               | `~/.secureci/`, the working directory, temp dirs                       | Caches actions and advisories, stores artifacts and config, and reads your workflow files.                                                                                                |
 | Hard-coded URLs          | GitHub documentation and JSON Schema URLs in messages and editor hints | Informational only; the CLI does not fetch them.                                                                                                                                          |
 
 No install scripts run for consumers. The published tarball contains only

package/dist/cli.js

@@ -795,13 +795,16 @@ async function validateFiles(files, contractFile, recurse, format, offline) {
         return;
     }
     for (const { file, result } of entries) {
-        if (result.valid) {
+        if (result.valid)
             logger_1.logger.success(`Validation passed: ${file}`);
-            result.errors.forEach((error) => logger_1.logger.warn(`  [${error.severity.toUpperCase()}] ${error.path}: ${error.message}`));
-        }
-        else {
+        else
             logger_1.logger.error(`Validation failed: ${file}`);
-            result.errors.forEach((error) => logger_1.logger.error(`  [${error.severity.toUpperCase()}] ${error.path}: ${error.message}`));
+        for (const error of result.errors) {
+            const line = `  [${error.severity.toUpperCase()}] ${error.path}: ${error.message}`;
+            if (error.severity === 'warning')
+                logger_1.logger.warn(line);
+            else
+                logger_1.logger.error(line);
         }
     }
     if (!allValid)

package/dist/parser/allow-comments.js

@@ -0,0 +1,113 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.stepAllowComments = stepAllowComments;
+const YAML = __importStar(require("yaml"));
+/** `# secureci-allow <rule>` with an optional `: <reason>`. */
+function directive(rule) {
+    const name = rule.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    return new RegExp(`^#\\s*secureci-allow\\s+${name}(?=\\s|:|$)(?::(.*))?$`);
+}
+/** Source offset of every comment, mapped to its text (`# ...`). */
+function commentOffsets(content) {
+    const comments = new Map();
+    let offset = 0;
+    for (const token of new YAML.Lexer().lex(content)) {
+        const type = YAML.CST.tokenType(token);
+        if (type === 'comment')
+            comments.set(offset, token);
+        // Control tokens mark the parser's state; they aren't in the source.
+        if (type !== 'doc-mode' && type !== 'flow-error-end' && type !== 'scalar') {
+            offset += token.length;
+        }
+    }
+    return comments;
+}
+/**
+ * Steps carrying a `# secureci-allow <rule>: <reason>` comment, as
+ * `jobs.<id>.steps[<i>]` paths mapped to the reason ('' when it's missing).
+ * The comment goes at the end of the step's first line (`- uses: ...`) or
+ * on a line of its own directly above the step; comments separated by a
+ * blank line, or inside the step, don't count.
+ */
+function stepAllowComments(content, rule) {
+    const allowed = new Map();
+    const doc = YAML.parseDocument(content);
+    if (doc.errors.length > 0)
+        return allowed;
+    const jobs = doc.get('jobs');
+    if (!YAML.isMap(jobs))
+        return allowed;
+    const comments = commentOffsets(content);
+    const pattern = directive(rule);
+    const lineStart = (offset) => content.lastIndexOf('\n', offset - 1) + 1;
+    for (const pair of jobs.items) {
+        const steps = YAML.isMap(pair.value) ? pair.value.get('steps') : undefined;
+        if (!YAML.isSeq(steps))
+            continue;
+        steps.items.forEach((step, i) => {
+            if (!YAML.isNode(step) || !step.range)
+                return;
+            const start = step.range[0];
+            const lineEnd = content.indexOf('\n', start);
+            const texts = [];
+            for (const [offset, text] of comments) {
+                if (offset >= start && (lineEnd === -1 || offset < lineEnd)) {
+                    texts.push(text);
+                }
+            }
+            // Whole-line comments directly above the step.
+            let line = lineStart(start);
+            while (line > 0) {
+                const above = lineStart(line - 1);
+                const indent = content.slice(above, line).search(/\S/);
+                const text = indent === -1 ? undefined : comments.get(above + indent);
+                if (text === undefined)
+                    break;
+                texts.push(text);
+                line = above;
+            }
+            for (const text of texts) {
+                const match = pattern.exec(text.trimEnd());
+                if (match) {
+                    allowed.set(`jobs.${String(pair.key)}.steps[${i}]`, (match[1] ?? '').trim());
+                    break;
+                }
+            }
+        });
+    }
+    return allowed;
+}
+//# sourceMappingURL=allow-comments.js.map

package/dist/parser/dangerous-triggers.js

@@ -4,6 +4,8 @@ exports.workflowTriggers = workflowTriggers;
 exports.dangerousTriggerErrors = dangerousTriggerErrors;
 exports.forbiddenTriggerErrors = forbiddenTriggerErrors;
 const RULE = 'secureci/dangerous-trigger';
+/** The comment that downgrades a finding on a checkout step. */
+const ALLOW = '# secureci-allow dangerous-trigger';
 /**
  * Triggers whose runs get the base repository's secrets and a read/write
  * `GITHUB_TOKEN` even when the change came from a fork.
@@ -51,6 +53,30 @@ function untrustedCheckoutInput(step) {
     }
     return undefined;
 }
+/**
+ * Whether `actions/checkout` itself refuses the untrusted checkout: since
+ * June 2026 it won't check out a fork's code under these triggers unless
+ * `allow-unsafe-pr-checkout` is set. v7 has it, and floating major tags
+ * (`@v4`) and branches got it backported; SHA, minor or patch pins and v1
+ * did not.
+ */
+function checkoutProtection(step) {
+    const optOut = step.with?.['allow-unsafe-pr-checkout'];
+    if (String(optOut).toLowerCase() === 'true') {
+        return (`allow-unsafe-pr-checkout: true explicitly turns off actions/checkout's refusal to ` +
+            `check out a fork's code under these triggers`);
+    }
+    const version = step.uses?.split('@')[1];
+    if (version !== undefined &&
+        (/^[0-9a-f]{40}$/i.test(version) ||
+            /^v\d+\.\d+/.test(version) ||
+            /^v1$/.test(version))) {
+        return (`the safe default of actions/checkout does not apply to @${version} ` +
+            `(only v7, floating major tags like @v4 and branches have it), so the checkout succeeds`);
+    }
+    return (`actions/checkout refuses this checkout by default, so the step fails until someone ` +
+        `sets allow-unsafe-pr-checkout: true, which would run the fork's code`);
+}
 /** How a step would execute checked-out code, or undefined if it doesn't. */
 function executes(step) {
     if (step.run)
@@ -72,8 +98,12 @@ function executes(step) {
  * - warning: a privileged trigger with no such job, once per trigger, so
  *   teams can audit it. Omitted when a job-level finding is reported, so
  *   a workflow is never reported twice for the same problem.
+ *
+ * `allowed` maps checkout step paths with a `# secureci-allow
+ * dangerous-trigger: <reason>` comment to the reason (see
+ * stepAllowComments); a reason downgrades that job's error to a warning.
  */
-function dangerousTriggerErrors(workflow) {
+function dangerousTriggerErrors(workflow, allowed = new Map()) {
     const triggers = workflowTriggers(workflow.on).filter((t) => PRIVILEGED_TRIGGERS.includes(t));
     if (triggers.length === 0)
         return [];
@@ -87,16 +117,24 @@ function dangerousTriggerErrors(workflow) {
         const runIdx = steps.findIndex((s, i) => i > checkoutIdx && executes(s) !== undefined);
         if (runIdx === -1)
             continue;
+        const path = `jobs.${jobId}.steps[${checkoutIdx}]`;
         const gated = LABEL_GATE.test(String(job.if ?? ''));
+        const reason = allowed.get(path);
         findings.push({
-            path: `jobs.${jobId}.steps[${checkoutIdx}]`,
+            path,
             message: `Job "${jobId}" checks out untrusted code (${untrustedCheckoutInput(steps[checkoutIdx])}) ` +
                 `in a workflow triggered by ${named}, then executes it at steps[${runIdx}] (${executes(steps[runIdx])}). ` +
-                `These triggers run with the repository's secrets and a write token, so a fork can run its own code with them` +
+                `These triggers run with the repository's secrets and a write token, so a fork can run its own code with them; ` +
+                `${checkoutProtection(steps[checkoutIdx])}` +
                 (gated
                     ? `. The job is gated by a label check in its if:, so review the pull request's code before applying the label`
-                    : `; check out the base ref instead, or move the build to an unprivileged pull_request workflow`),
-            severity: gated ? 'warning' : 'error',
+                    : `. Check out the base ref instead, or move the build to an unprivileged pull_request workflow`) +
+                (reason
+                    ? `. Downgraded to a warning by "${ALLOW}" on this step: ${reason}`
+                    : reason === ''
+                        ? `. The "${ALLOW}" comment on this step needs a reason (${ALLOW}: <reason>) to downgrade this to a warning`
+                        : ''),
+            severity: gated || reason ? 'warning' : 'error',
             rule: RULE
         });
     }

package/dist/parser/validator.js

@@ -1,15 +1,50 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.workflowExpressionErrors = workflowExpressionErrors;
 exports.actionExpressionErrors = actionExpressionErrors;
 exports.validateWorkflow = validateWorkflow;
 exports.mergeValidationResults = mergeValidationResults;
 exports.validateAction = validateAction;
+const fs = __importStar(require("fs"));
 const workflow_parser_1 = require("./workflow-parser");
 const expression_1 = require("../runner/expression");
 const injection_1 = require("./injection");
 const permissions_1 = require("./permissions");
 const dangerous_triggers_1 = require("./dangerous-triggers");
+const allow_comments_1 = require("./allow-comments");
 /**
  * Invalid `if:` expressions in a workflow: syntax errors, or contexts and
  * functions not available where they're used. GitHub rejects such a
@@ -126,7 +161,7 @@ function validateWorkflow(filePath) {
         errors.push(...workflowExpressionErrors(workflow));
         errors.push(...(0, injection_1.workflowInjectionErrors)(workflow, filePath));
         errors.push(...(0, permissions_1.workflowPermissionErrors)(workflow));
-        errors.push(...(0, dangerous_triggers_1.dangerousTriggerErrors)(workflow));
+        errors.push(...(0, dangerous_triggers_1.dangerousTriggerErrors)(workflow, (0, allow_comments_1.stepAllowComments)(fs.readFileSync(filePath, 'utf-8'), 'dangerous-trigger')));
     }
     catch (error) {
         errors.push({

package/dist/report.js

@@ -28,7 +28,8 @@ function jsonForFile(entry) {
         errors: entry.result.errors.map((e) => ({
             path: e.path,
             message: e.message,
-            severity: e.severity
+            severity: e.severity,
+            rule: ruleIdFor(e)
         }))
     };
 }

package/dist/runner/action-fetcher.js

@@ -43,6 +43,7 @@ exports.lsRemoteSha = lsRemoteSha;
 exports.parseLsRemoteTags = parseLsRemoteTags;
 exports.lsRemoteTags = lsRemoteTags;
 exports.getText = getText;
+exports.followRedirect = followRedirect;
 exports.fetchAction = fetchAction;
 exports.fetchRepoFile = fetchRepoFile;
 exports.clearActionCache = clearActionCache;
@@ -62,6 +63,11 @@ const execFileAsync = (0, util_1.promisify)(child_process_1.execFile);
 /** Default connect/idle timeout for action downloads. */
 const DOWNLOAD_TIMEOUT_MS = 30000;
 const MAX_REDIRECTS = 5;
+// GitHub owner and repository names; never `.`/`..` (they'd be cache paths).
+const NAME = /^[A-Za-z0-9_.][A-Za-z0-9_.-]*$/;
+const validName = (name) => NAME.test(name) && name !== '.' && name !== '..';
+/** API lookups are small; refuse anything bigger than this. */
+const MAX_TEXT_BYTES = 16 * 1024 * 1024;
 /**
  * Parse an action reference like "actions/checkout@v3" or "owner/repo/path@ref"
  */
@@ -73,6 +79,10 @@ function parseActionReference(uses) {
         return null;
     }
     const [, owner, repo, actionPath, ref] = match;
+    if (!validName(owner) || !validName(repo)) {
+        logger_1.logger.warn(`Invalid action reference format: ${uses}`);
+        return null;
+    }
     return {
         owner,
         repo,
@@ -216,8 +226,16 @@ function getText(url, headers, timeoutMs) {
         const client = url.startsWith('http://') ? http : https;
         const request = client.get(url, { headers }, (response) => {
             let body = '';
+            let size = 0;
             response.setEncoding('utf8');
-            response.on('data', (chunk) => (body += chunk));
+            response.on('data', (chunk) => {
+                size += Buffer.byteLength(chunk);
+                if (size > MAX_TEXT_BYTES) {
+                    request.destroy(new Error(`Response too large: ${url}`));
+                    return;
+                }
+                body += chunk;
+            });
             response.on('end', () => response.statusCode === 200
                 ? resolve(body)
                 : reject(Object.assign(new Error(`HTTP ${response.statusCode}`), {
@@ -252,6 +270,22 @@ async function resolveSha(ref, token, timeoutMs) {
         sha: await lsRemoteSha(`${serverUrl()}/${ref.owner}/${ref.repo}.git`, ref.ref)
     };
 }
+/**
+ * Where a redirect from `url` to `location` goes, and with which headers:
+ * the Authorization header only stays on the same host, and an https URL
+ * never redirects to http.
+ */
+function followRedirect(url, location, headers) {
+    const from = new URL(url);
+    const next = new URL(location, url);
+    if (from.protocol === 'https:' && next.protocol !== 'https:') {
+        throw new Error(`Refusing insecure redirect from ${url} to ${next}`);
+    }
+    const nextHeaders = { ...headers };
+    if (next.host !== from.host)
+        delete nextHeaders.Authorization;
+    return { url: next.toString(), headers: nextHeaders };
+}
 /**
  * Download a URL to a file, following up to MAX_REDIRECTS redirects. The
  * Authorization header is only sent to the original host (GitHub's API
@@ -274,12 +308,15 @@ function downloadFile(url, dest, timeoutMs, headers, redirectsLeft = MAX_REDIREC
                     reject(new Error(`Too many redirects downloading ${url}`));
                 }
                 else {
-                    const next = new URL(location, url);
-                    const nextHeaders = { ...headers };
-                    if (next.host !== new URL(url).host) {
-                        delete nextHeaders.Authorization;
+                    let next;
+                    try {
+                        next = followRedirect(url, location, headers);
+                    }
+                    catch (error) {
+                        reject(error);
+                        return;
                     }
-                    downloadFile(next.toString(), dest, timeoutMs, nextHeaders, redirectsLeft - 1).then(resolve, reject);
+                    downloadFile(next.url, dest, timeoutMs, next.headers, redirectsLeft - 1).then(resolve, reject);
                 }
                 return;
             }

package/dist/runner/builtin-actions.js

@@ -58,7 +58,7 @@ function hostFileSystem(workspace) {
         workspace,
         home: os.homedir(),
         path: path,
-        readable: async (logical) => (fs.existsSync(logical) ? logical : null),
+        readable: async (logical) => fs.existsSync(logical) ? fs.realpathSync(logical) : null,
         writeInto: async (logical, fill) => {
             fs.mkdirSync(logical, { recursive: true });
             fill(logical);
@@ -76,24 +76,58 @@ function containerFileSystem(access) {
         return dir;
     };
     const inWorkspace = (logical) => logical === access.workspace || logical.startsWith(access.workspace + '/');
-    const toHost = (logical) => path.join(access.hostWorkspace, ...p.relative(access.workspace, logical).split('/'));
+    const segments = (logical) => p.relative(access.workspace, logical).split('/').filter(Boolean);
+    // The container can put symlinks in the mounted workspace; on the host
+    // they resolve against the host's filesystem. Every workspace path is
+    // resolved and must stay inside the workspace.
+    const hostRoot = () => fs.realpathSync(access.hostWorkspace);
+    const contained = (root, real) => real === root || real.startsWith(root + path.sep);
     return {
         workspace: access.workspace,
         home: access.home,
         path: p,
         readable: async (logical) => {
             if (inWorkspace(logical)) {
-                const host = toHost(logical);
-                return fs.existsSync(host) ? host : null;
+                const root = hostRoot();
+                let real;
+                try {
+                    real = fs.realpathSync(path.join(root, ...segments(logical)));
+                }
+                catch {
+                    return null;
+                }
+                return contained(root, real) ? real : null;
             }
             const target = path.join(tempDir(), 'copy');
             return (await access.copyFrom(logical, target)) ? target : null;
         },
         writeInto: async (logical, fill) => {
             if (inWorkspace(logical)) {
-                const host = toHost(logical);
-                fs.mkdirSync(host, { recursive: true });
-                fill(host);
+                const root = hostRoot();
+                let dir = root;
+                for (const part of segments(logical)) {
+                    const next = path.join(dir, part);
+                    const stat = lstatOrNull(next);
+                    if (!stat) {
+                        fs.mkdirSync(next);
+                        dir = next;
+                    }
+                    else if (stat.isDirectory()) {
+                        dir = next;
+                    }
+                    else {
+                        const real = stat.isSymbolicLink() ? realpathOrNull(next) : null;
+                        if (!real || !contained(root, real)) {
+                            throw new Error(`Refusing to write to ${logical}: it is outside the workspace or not a directory`);
+                        }
+                        dir = real;
+                    }
+                }
+                // Fill a private staging directory, then merge it in without
+                // following any symlink the container left in the destination.
+                const stage = tempDir();
+                fill(stage);
+                mergeNoFollow(stage, dir);
                 return;
             }
             const stage = tempDir();
@@ -110,8 +144,63 @@ function containerFileSystem(access) {
         }
     };
 }
+function lstatOrNull(file) {
+    try {
+        return fs.lstatSync(file);
+    }
+    catch {
+        return null;
+    }
+}
+function realpathOrNull(file) {
+    try {
+        return fs.realpathSync(file);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Copy the tree `from` into `to`, replacing (never following) symlinks in
+ * `to`, so the copy can't land outside it.
+ */
+function mergeNoFollow(from, to) {
+    for (const entry of fs.readdirSync(from, { withFileTypes: true })) {
+        const src = path.join(from, entry.name);
+        const dst = path.join(to, entry.name);
+        let stat = lstatOrNull(dst);
+        if (stat?.isSymbolicLink()) {
+            fs.unlinkSync(dst);
+            stat = null;
+        }
+        if (entry.isDirectory()) {
+            if (!stat)
+                fs.mkdirSync(dst);
+            else if (!stat.isDirectory()) {
+                throw new Error(`Cannot overwrite non-directory ${dst} with a directory`);
+            }
+            mergeNoFollow(src, dst);
+        }
+        else if (entry.isFile()) {
+            const fd = fs.openSync(dst, fs.constants.O_WRONLY |
+                fs.constants.O_CREAT |
+                fs.constants.O_TRUNC |
+                (fs.constants.O_NOFOLLOW ?? 0));
+            try {
+                fs.writeFileSync(fd, fs.readFileSync(src));
+                fs.fchmodSync(fd, fs.statSync(src).mode & 0o7777);
+            }
+            finally {
+                fs.closeSync(fd);
+            }
+        }
+    }
+}
 function listFiles(hostRoot, base = '') {
-    const stat = fs.statSync(hostRoot);
+    // Never follow a symlink (e.g. one copied out of a container).
+    const stat = fs.lstatSync(hostRoot);
+    if (stat.isSymbolicLink())
+        return [];
     if (stat.isFile())
         return [base];
     const files = [];
@@ -170,7 +259,7 @@ async function collectFiles(fsys, patterns, options) {
         const host = await fsys.readable(searchPath);
         if (!host)
             continue;
-        const isFile = fs.statSync(host).isFile();
+        const isFile = fs.lstatSync(host).isFile();
         searchPaths.push(isFile ? p.dirname(searchPath) : searchPath);
         const matcher = globAt === -1 ? undefined : (0, hash_files_1.globToRegExp)(pattern);
         for (const rel of listFiles(host)) {

package/dist/runner/checkout.js

@@ -86,6 +86,21 @@ function isLocalCheckout(uses, withValues, ctx) {
  * cloned and `.git` is never touched. With `path:`, the working copy is
  * copied into that subdirectory and the copy is removed at job end.
  */
+/**
+ * Whether `dest` (or the closest part of it that exists) resolves outside
+ * `workspace` through a symlink, e.g. one a container step planted.
+ */
+function escapesViaSymlink(workspace, dest) {
+    const root = fs.realpathSync(workspace);
+    let existing = dest;
+    while (!fs.existsSync(existing) && existing !== path.dirname(existing)) {
+        if (fs.lstatSync(existing, { throwIfNoEntry: false }))
+            return true; // dangling link
+        existing = path.dirname(existing);
+    }
+    const real = fs.realpathSync(existing);
+    return real !== root && !real.startsWith(root + path.sep);
+}
 function localCheckout(step, ctx, runtime, startTime) {
     const withValues = (0, expression_1.substituteRecord)(step.with, ctx);
     const outputs = {
@@ -104,7 +119,9 @@ function localCheckout(step, ctx, runtime, startTime) {
     const workspace = process.cwd();
     const dest = path.resolve(workspace, withValues.path || '.');
     const relative = path.relative(workspace, dest);
-    if (relative.startsWith('..') || path.isAbsolute(relative)) {
+    if (relative.startsWith('..') ||
+        path.isAbsolute(relative) ||
+        escapesViaSymlink(workspace, dest)) {
         return fail(`actions/checkout: path "${withValues.path}" is outside the workspace`);
     }
     let output = 'Using local working copy';

package/dist/runner/container-policy.js

@@ -0,0 +1,166 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.invalidImageReason = invalidImageReason;
+exports.unsafeServiceOptions = unsafeServiceOptions;
+exports.unsafeServiceVolumeReason = unsafeServiceVolumeReason;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+/**
+ * What the CLI lets workflow and action content pass to the container
+ * engine. Container isolation is the boundary between third-party code
+ * (remote actions, remote reusable workflows) and this machine, so anything
+ * that would let a container reach the host is refused.
+ */
+// A Docker image reference: never an option, never whitespace.
+const IMAGE = /^[A-Za-z0-9][A-Za-z0-9._\-/:@]*$/;
+/** Why `image` can't be passed to the container engine, if it can't. */
+function invalidImageReason(image) {
+    return IMAGE.test(image)
+        ? undefined
+        : `Invalid image reference ${JSON.stringify(image)}: an image name can't be empty, start with "-" or contain whitespace`;
+}
+/**
+ * `docker run` options that give a container the host's privileges,
+ * namespaces, devices or filesystem.
+ */
+const UNSAFE_LONG_OPTIONS = new Set([
+    '--privileged',
+    '--cap-add',
+    '--security-opt',
+    '--pid',
+    '--network',
+    '--net',
+    '--ipc',
+    '--userns',
+    '--uts',
+    '--cgroupns',
+    '--device',
+    '--device-cgroup-rule',
+    '--volume',
+    '--mount',
+    '--volumes-from',
+    '--runtime',
+    '--cgroup-parent'
+]);
+const UNSAFE_SHORT_OPTIONS = new Set(['-v']);
+/** Long options that take a value as the next argument (when no `=`). */
+const VALUE_OPTIONS = new Set([
+    ...[...UNSAFE_LONG_OPTIONS].filter((o) => o !== '--privileged'),
+    '--health-cmd',
+    '--health-interval',
+    '--health-timeout',
+    '--health-retries',
+    '--health-start-period',
+    '--entrypoint',
+    '--env',
+    '--shm-size',
+    '--tmpfs',
+    '--user',
+    '--hostname',
+    '--workdir',
+    '--name',
+    '--memory',
+    '--cpus',
+    '--label',
+    '--add-host',
+    '--ulimit'
+]);
+const SHORT_VALUE_OPTIONS = new Set(['-v', '-e', '-u', '-w', '-h', '-l', '-m']);
+/**
+ * The unsafe options in `args` (`services.<id>.options`), by flag name, in
+ * order. Values of options are skipped, so `--health-cmd --privileged` is
+ * fine.
+ */
+function unsafeServiceOptions(args) {
+    const found = [];
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        if (arg.startsWith('--')) {
+            const [name, value] = arg.split(/=(.*)/s);
+            if (UNSAFE_LONG_OPTIONS.has(name))
+                found.push(name);
+            if (value === undefined && VALUE_OPTIONS.has(name))
+                i++;
+        }
+        else if (arg.startsWith('-') && arg.length > 1) {
+            const name = arg.slice(0, 2);
+            if (UNSAFE_SHORT_OPTIONS.has(name))
+                found.push(name);
+            if (arg.length === 2 && SHORT_VALUE_OPTIONS.has(name))
+                i++;
+        }
+    }
+    return found;
+}
+const VOLUME_NAME = /^[A-Za-z0-9][A-Za-z0-9_.-]*$/;
+function realpathOrSelf(p) {
+    try {
+        return fs.realpathSync(p);
+    }
+    catch {
+        return p;
+    }
+}
+/**
+ * Why a `services.<id>.volumes` entry is refused, if it is. Named and
+ * anonymous volumes are fine; a host bind mount must stay inside the
+ * workspace (after following symlinks) and away from its `.git`.
+ */
+function unsafeServiceVolumeReason(spec, workspace) {
+    const parts = spec.split(':');
+    if (parts.length < 2)
+        return undefined; // anonymous volume: `/data`
+    const source = parts[0];
+    if (VOLUME_NAME.test(source))
+        return undefined; // named volume
+    if (!path.isAbsolute(source)) {
+        return `Volume ${JSON.stringify(spec)} uses a relative or unsupported host path; use an absolute path inside the workspace or a named volume`;
+    }
+    const root = realpathOrSelf(workspace);
+    const real = realpathOrSelf(source);
+    const rel = path.relative(root, real);
+    if (rel.startsWith('..') || path.isAbsolute(rel)) {
+        return `Volume ${JSON.stringify(spec)} mounts a host path outside the workspace`;
+    }
+    const git = path.join(root, '.git');
+    if (real === git ||
+        real.startsWith(git + path.sep) ||
+        (rel === '' && fs.existsSync(git))) {
+        return `Volume ${JSON.stringify(spec)} would expose the repository's .git to the container`;
+    }
+    return undefined;
+}
+//# sourceMappingURL=container-policy.js.map

package/dist/runner/container-runtime.js

@@ -41,6 +41,7 @@ const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const util_1 = require("util");
+const container_policy_1 = require("./container-policy");
 const execAsync = (0, util_1.promisify)(child_process_1.exec);
 /** The CLI binary invoked for each runtime. `containerd` has no Docker-CLI-
  * compatible binary of its own, so `nerdctl` is used as its front-end. */
@@ -98,6 +99,21 @@ function envTransport(env = {}) {
         }
     };
 }
+/**
+ * `-v` mounts that put existing `paths` under `workingDir` back read-only
+ * over the workspace mount, so a container can't rewrite them (a step
+ * writing `.git/hooks` would otherwise run code on the host later).
+ */
+function readOnlyMounts(workingDir, paths = []) {
+    const args = [];
+    for (const rel of paths) {
+        const host = path.join(workingDir, rel);
+        if (!fs.existsSync(host))
+            continue;
+        args.push('-v', `${host}:${path.posix.join(exports.CONTAINER_WORKDIR, ...rel.split(path.sep))}:ro`);
+    }
+    return args;
+}
 /** Probe timeout for `<bin> version` availability checks. */
 const PROBE_TIMEOUT_MS = 3000;
 class CliContainerRuntime {
@@ -123,6 +139,17 @@ class CliContainerRuntime {
         return this.availableCache;
     }
     execute(options) {
+        const invalid = (0, container_policy_1.invalidImageReason)(options.image);
+        if (invalid) {
+            return Promise.resolve({
+                success: false,
+                stdout: '',
+                stderr: invalid,
+                exitCode: null,
+                timedOut: false,
+                durationMs: 0
+            });
+        }
         const args = [
             'run',
             '--rm',
@@ -130,6 +157,7 @@ class CliContainerRuntime {
             exports.CONTAINER_WORKDIR,
             '-v',
             `${options.workingDir}:${exports.CONTAINER_WORKDIR}`,
+            ...readOnlyMounts(options.workingDir, options.readOnlyPaths),
             '-v',
             `${options.exchangeDir}:${exports.CONTAINER_EXCHANGE_DIR}`
         ];
@@ -154,9 +182,12 @@ class CliContainerRuntime {
         return this.runCli(args, options.timeoutMs, env);
     }
     start(options) {
+        const invalid = (0, container_policy_1.invalidImageReason)(options.image);
+        if (invalid)
+            return Promise.resolve({ success: false, error: invalid });
         const args = ['run', '-d'];
         if (options.workingDir) {
-            args.push('-w', exports.CONTAINER_WORKDIR, '-v', `${options.workingDir}:${exports.CONTAINER_WORKDIR}`);
+            args.push('-w', exports.CONTAINER_WORKDIR, '-v', `${options.workingDir}:${exports.CONTAINER_WORKDIR}`, ...readOnlyMounts(options.workingDir, options.readOnlyPaths));
         }
         if (options.exchangeDir) {
             args.push('-v', `${options.exchangeDir}:${exports.CONTAINER_EXCHANGE_DIR}`);

package/dist/runner/docker-action.js

@@ -43,6 +43,7 @@ const expression_1 = require("./expression");
 const container_runtime_1 = require("./container-runtime");
 const runner_env_1 = require("./runner-env");
 const job_runtime_1 = require("./job-runtime");
+const job_container_1 = require("./job-container");
 const node_action_1 = require("./node-action");
 /**
  * Execute a Docker-type action (`runs.using: docker`). Unlike `run:` steps,
@@ -114,6 +115,12 @@ async function executeDockerAction(action, actionPath, step, actionInputs, calle
     // `runs.args` may reference ${{ inputs.* }} / ${{ secrets.* }}.
     const actionCtx = (0, expression_1.createContext)({}, actionInputs, options.secrets);
     const args = (action.runs.args || []).map((arg) => (0, expression_1.substituteExpressions)(arg, actionCtx));
+    // Args go on the engine client's command line, which other local users
+    // can read (`ps`); env values don't, so say so when a secret lands here.
+    const secretValues = Object.values(options.secrets ?? {}).filter((value) => value && value.length >= 3);
+    if (args.some((arg) => secretValues.some((value) => arg.includes(value)))) {
+        logger_1.logger.warn(`Docker action "${step.uses}": a secret is passed in its args, so it is on the container engine's command line, visible to other users of this machine. Pass secrets through env: instead.`);
+    }
     logger_1.logger.info(`Executing Docker action: ${action.name}`);
     const exchangeDir = fs.mkdtempSync(path.join(os.tmpdir(), 'secureci-exchange-'));
     const files = (0, runner_env_1.createStepFiles)(exchangeDir);
@@ -125,6 +132,7 @@ async function executeDockerAction(action, actionPath, step, actionInputs, calle
             args,
             entrypoint: action.runs.entrypoint,
             workingDir: process.cwd(),
+            readOnlyPaths: (0, job_container_1.protectedWorkspacePaths)(options),
             exchangeDir,
             env: {
                 ...(0, job_runtime_1.containerRunnerEnv)(runtime),

package/dist/runner/job-container.js

@@ -41,6 +41,7 @@ exports.runnerImage = runnerImage;
 exports.stopJobContainer = stopJobContainer;
 exports.startJobServices = startJobServices;
 exports.stopJobServices = stopJobServices;
+exports.protectedWorkspacePaths = protectedWorkspacePaths;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const crypto = __importStar(require("crypto"));
@@ -48,6 +49,7 @@ const logger_1 = require("../utils/logger");
 const expression_1 = require("./expression");
 const container_runtime_1 = require("./container-runtime");
 const shell_1 = require("./shell");
+const container_policy_1 = require("./container-policy");
 /**
  * Image for jobs whose `runs-on` has no image mapping. Runner-like (Node.js,
  * git, curl and common tools), as used by nektos/act.
@@ -145,6 +147,7 @@ async function startJobContainer(job, ctx, options, runtime, runDir) {
     const started = await containerRuntime.start({
         image,
         workingDir: process.cwd(),
+        readOnlyPaths: protectedWorkspacePaths(options),
         exchangeDir,
         env: containerEnv,
         memoryLimit: options.containerMemoryLimit,
@@ -254,6 +257,22 @@ async function startJobServices(job, ctx, options, runtime) {
     const contexts = {};
     for (const [serviceId, spec] of specs) {
         const service = typeof spec === 'string' ? { image: spec } : spec;
+        const extraArgs = service.options
+            ? (0, shell_1.splitArgs)((0, expression_1.substituteExpressions)(service.options, ctx))
+            : [];
+        const volumes = (service.volumes ?? []).map((v) => (0, expression_1.substituteExpressions)(v, ctx));
+        const unsafe = (0, container_policy_1.unsafeServiceOptions)(extraArgs);
+        if (unsafe.length > 0) {
+            logger_1.logger.error(`services.${serviceId}: refusing unsafe options ${[...new Set(unsafe)].join(', ')}: they would give the container access to this machine.`);
+            return false;
+        }
+        for (const volume of volumes) {
+            const reason = (0, container_policy_1.unsafeServiceVolumeReason)(volume, process.cwd());
+            if (reason) {
+                logger_1.logger.error(`services.${serviceId}: ${reason}.`);
+                return false;
+            }
+        }
         if (service.credentials) {
             logger_1.logger.warn(`services.${serviceId}: credentials are ignored; log in with \`docker login\` instead.`);
         }
@@ -266,10 +285,8 @@ async function startJobServices(job, ctx, options, runtime) {
                 ? { network: services.network, networkAlias: serviceId }
                 : {}),
             ports: (service.ports ?? []).map((port) => (0, expression_1.substituteExpressions)(String(port), ctx)),
-            volumes: (service.volumes ?? []).map((v) => (0, expression_1.substituteExpressions)(v, ctx)),
-            extraArgs: service.options
-                ? (0, shell_1.splitArgs)((0, expression_1.substituteExpressions)(service.options, ctx))
-                : [],
+            volumes,
+            extraArgs,
             env: (0, expression_1.substituteRecord)(service.env, ctx)
         });
         if (!started.success || !started.id) {
@@ -319,4 +336,12 @@ async function stopJobServices(runtime) {
         await services.runtime.removeNetwork(services.network);
     }
 }
+/**
+ * Workspace paths mounted read-only into containers: the working copy's
+ * `.git`, so a step can't plant hooks or config that run on the host. Not
+ * with --no-local-checkout, where the real actions/checkout manages it.
+ */
+function protectedWorkspacePaths(options) {
+    return options.localCheckout === false ? [] : ['.git'];
+}
 //# sourceMappingURL=job-container.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@secureci/cli",
-  "version": "0.6.0",
+  "version": "0.8.0",
   "description": "SecureCI: validate, check against pipeline standards, and run GitHub Actions workflows locally",
   "main": "dist/index.js",
   "bin": {
@@ -68,11 +68,11 @@
     "@types/node": "^20.10.6",
     "@typescript-eslint/eslint-plugin": "^8.71.1",
     "@typescript-eslint/parser": "^8.71.1",
-    "@vitest/coverage-v8": "^4.1.11",
+    "@vitest/coverage-v8": "^4.1.12",
     "eslint": "^8.56.0",
     "postject": "1.0.0-alpha.6",
     "typescript": "^5.3.3",
-    "vitest": "^4.1.11"
+    "vitest": "^4.1.12"
   },
   "volta": {
     "node": "24.0.0"