@shepai/cli 1.175.0 → 1.175.1-pr527.ea242b8

package/dist/packages/core/src/infrastructure/services/external/github-repository.service.d.ts

@@ -5,7 +5,7 @@
  * checks, repository listing, cloning (with progress streaming), and URL parsing.
  */
 import type { ExecFunction } from '../git/worktree.service.js';
-import type { IGitHubRepositoryService, GitHubRepo, GitHubOrganization, ListUserRepositoriesOptions, CloneOptions, ParsedGitHubUrl, ForkOptions, PushAccessResult, ForkResult } from '../../../application/ports/output/services/github-repository-service.interface.js';
+import type { IGitHubRepositoryService, GitHubRepo, GitHubOrganization, ListUserRepositoriesOptions, CloneOptions, ParsedGitHubUrl, ForkOptions, PushAccessResult, ForkResult, GovernanceFinding } from '../../../application/ports/output/services/github-repository-service.interface.js';
 export declare class GitHubRepositoryService implements IGitHubRepositoryService {
     private readonly execFile;
     constructor(execFile: ExecFunction);
@@ -18,6 +18,15 @@ export declare class GitHubRepositoryService implements IGitHubRepositoryService
     getAuthenticatedUser(): Promise<string>;
     checkPushAccess(nameWithOwner: string): Promise<PushAccessResult>;
     forkRepository(nameWithOwner: string, options?: ForkOptions): Promise<ForkResult>;
+    auditRepositoryGovernance(owner: string, repo: string, defaultBranch?: string): Promise<GovernanceFinding[]>;
+    private checkBranchProtection;
+    private checkCodeowners;
+    /**
+     * Handle errors from governance API calls gracefully.
+     * 404 errors are treated as findings (missing config).
+     * Auth/permission errors are treated as Unknown severity findings.
+     */
+    private handleGovernanceCheckError;
     private cleanupPartialClone;
 }
 //# sourceMappingURL=github-repository.service.d.ts.map

package/dist/packages/core/src/infrastructure/services/external/github-repository.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"github-repository.service.d.ts","sourceRoot":"","sources":["../../../../../../../packages/core/src/infrastructure/services/external/github-repository.service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,KAAK,EACV,wBAAwB,EACxB,UAAU,EACV,kBAAkB,EAClB,2BAA2B,EAC3B,YAAY,EACZ,eAAe,EACf,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,mFAAmF,CAAC;AA0B3F,qBACa,uBAAwB,YAAW,wBAAwB;IAClC,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,YAAY;IAErE,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;IAyB1B,oBAAoB,CAAC,OAAO,CAAC,EAAE,2BAA2B,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAuClF,iBAAiB,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;IA2BlD,eAAe,CACnB,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,YAAY,GACrB,OAAO,CAAC,IAAI,CAAC;IAgDhB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe;IA2CtC,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAyBtD,oBAAoB,IAAI,OAAO,CAAC,MAAM,CAAC;IAUvC,eAAe,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAuBjE,cAAc,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;YAyBzE,mBAAmB;CAOlC"}
+{"version":3,"file":"github-repository.service.d.ts","sourceRoot":"","sources":["../../../../../../../packages/core/src/infrastructure/services/external/github-repository.service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,KAAK,EACV,wBAAwB,EACxB,UAAU,EACV,kBAAkB,EAClB,2BAA2B,EAC3B,YAAY,EACZ,eAAe,EACf,WAAW,EACX,gBAAgB,EAChB,UAAU,EACV,iBAAiB,EAClB,MAAM,mFAAmF,CAAC;AA2B3F,qBACa,uBAAwB,YAAW,wBAAwB;IAClC,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,YAAY;IAErE,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;IAyB1B,oBAAoB,CAAC,OAAO,CAAC,EAAE,2BAA2B,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAuClF,iBAAiB,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;IA2BlD,eAAe,CACnB,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,YAAY,GACrB,OAAO,CAAC,IAAI,CAAC;IAgDhB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe;IA2CtC,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAyBtD,oBAAoB,IAAI,OAAO,CAAC,MAAM,CAAC;IAUvC,eAAe,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAuBjE,cAAc,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;IAyBjF,yBAAyB,CAC7B,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,aAAa,SAAS,GACrB,OAAO,CAAC,iBAAiB,EAAE,CAAC;YAcjB,qBAAqB;YAmCrB,eAAe;IA6B7B;;;;OAIG;IACH,OAAO,CAAC,0BAA0B;YA6CpB,mBAAmB;CAOlC"}

package/dist/packages/core/src/infrastructure/services/external/github-repository.service.js

@@ -20,7 +20,7 @@ import { injectable, inject } from 'tsyringe';
 import { resolve, normalize } from 'node:path';
 import { rm } from 'node:fs/promises';
 import { spawn } from 'node:child_process';
-import { GitHubAuthError, GitHubCloneError, GitHubForkError, GitHubPermissionError, GitHubRepoListError, GitHubUrlParseError, } from '../../../application/ports/output/services/github-repository-service.interface.js';
+import { GitHubAuthError, GitHubCloneError, GitHubForkError, GitHubPermissionError, GitHubRepoListError, GitHubUrlParseError, GovernanceFindingCategory, } from '../../../application/ports/output/services/github-repository-service.interface.js';
 // ---------------------------------------------------------------------------
 // URL regex patterns
 // ---------------------------------------------------------------------------
@@ -245,6 +245,106 @@ let GitHubRepositoryService = class GitHubRepositoryService {
             throw new GitHubForkError(`Failed to fork ${nameWithOwner}: ${err.message}`, err);
         }
     }
+    async auditRepositoryGovernance(owner, repo, defaultBranch = 'main') {
+        const findings = [];
+        // Check branch protection
+        const branchFindings = await this.checkBranchProtection(owner, repo, defaultBranch);
+        findings.push(...branchFindings);
+        // Check CODEOWNERS presence
+        const codeownersFindings = await this.checkCodeowners(owner, repo);
+        findings.push(...codeownersFindings);
+        return findings;
+    }
+    async checkBranchProtection(owner, repo, branch) {
+        try {
+            const { stdout } = await this.execFile('gh', [
+                'api',
+                `/repos/${owner}/${repo}/branches/${branch}/protection`,
+            ]);
+            const protection = JSON.parse(stdout);
+            // Protection exists — check for PR review requirements
+            if (!protection.required_pull_request_reviews) {
+                return [
+                    {
+                        category: GovernanceFindingCategory.BranchProtection,
+                        severity: 'Medium',
+                        message: `Branch "${branch}" has protection enabled but does not require pull request reviews.`,
+                        remediation: `Enable "Require a pull request before merging" in branch protection settings for "${branch}".`,
+                    },
+                ];
+            }
+            return [];
+        }
+        catch (error) {
+            return this.handleGovernanceCheckError(error, GovernanceFindingCategory.BranchProtection, `Branch "${branch}" has no branch protection rules configured.`, `Enable branch protection for "${branch}" in repository settings. Require pull request reviews and status checks.`);
+        }
+    }
+    async checkCodeowners(owner, repo) {
+        // CODEOWNERS can live in repo root or .github/ directory
+        const paths = [
+            `/repos/${owner}/${repo}/contents/CODEOWNERS`,
+            `/repos/${owner}/${repo}/contents/.github/CODEOWNERS`,
+        ];
+        for (const path of paths) {
+            try {
+                await this.execFile('gh', ['api', path]);
+                // Found CODEOWNERS — no finding needed
+                return [];
+            }
+            catch {
+                // Not found at this path — try next
+            }
+        }
+        // Neither location found
+        return [
+            {
+                category: GovernanceFindingCategory.Codeowners,
+                severity: 'Medium',
+                message: 'No CODEOWNERS file found in the repository.',
+                remediation: 'Add a CODEOWNERS file to the repository root or .github/ directory to enforce code review ownership.',
+            },
+        ];
+    }
+    /**
+     * Handle errors from governance API calls gracefully.
+     * 404 errors are treated as findings (missing config).
+     * Auth/permission errors are treated as Unknown severity findings.
+     */
+    handleGovernanceCheckError(error, category, notFoundMessage, notFoundRemediation) {
+        const errMessage = error instanceof Error ? error.message : String(error);
+        const errnoCode = error?.code;
+        // gh not installed
+        if (errnoCode === 'ENOENT') {
+            return [
+                {
+                    category,
+                    severity: 'Unknown',
+                    message: 'GitHub CLI (gh) is not installed. Cannot audit repository governance.',
+                    remediation: 'Install the GitHub CLI from https://cli.github.com/',
+                },
+            ];
+        }
+        // 404 = resource not configured (branch protection, file missing, etc.)
+        if (errMessage.includes('404')) {
+            return [
+                {
+                    category,
+                    severity: 'High',
+                    message: notFoundMessage,
+                    remediation: notFoundRemediation,
+                },
+            ];
+        }
+        // Auth/permission errors or other unexpected failures — return Unknown finding
+        return [
+            {
+                category,
+                severity: 'Unknown',
+                message: `Unable to audit ${category}: ${errMessage}`,
+                remediation: 'Verify that the GitHub CLI is authenticated with sufficient permissions. Run `gh auth login`.',
+            },
+        ];
+    }
     async cleanupPartialClone(destination) {
         try {
             await rm(destination, { recursive: true, force: true });

package/dist/packages/core/src/infrastructure/services/security/dependency-risk-evaluator.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Dependency Risk Evaluator
+ *
+ * Evaluates repository-local dependency risk signals without
+ * external services. Checks:
+ * - Manifest-lockfile consistency (package.json vs lockfile)
+ * - Dependency source types (registry vs git vs file)
+ * - Risky lifecycle scripts (preinstall, postinstall, prepare)
+ * - Allowlist/denylist enforcement
+ * - Version-range strictness
+ *
+ * Returns an array of DependencyFinding objects with severity and remediation.
+ */
+import type { DependencyFinding, DependencyRules } from '../../../domain/generated/output.js';
+export declare class DependencyRiskEvaluator {
+    /**
+     * Evaluate dependency risk for a repository.
+     *
+     * @param repositoryPath - Absolute path to the repository root
+     * @param rules - Dependency risk policy rules
+     * @returns Array of dependency findings
+     */
+    evaluate(repositoryPath: string, rules: DependencyRules): DependencyFinding[];
+    /**
+     * Collect all dependencies from package.json (dependencies + devDependencies).
+     */
+    private collectDependencies;
+    /**
+     * Check that a lockfile exists when there are dependencies.
+     */
+    private checkLockfileConsistency;
+    /**
+     * Check for dependencies installed from non-registry sources.
+     */
+    private checkNonRegistrySources;
+    /**
+     * Check installed packages for risky lifecycle scripts.
+     */
+    private checkLifecycleScripts;
+    /**
+     * Check dependencies against the denylist.
+     */
+    private checkDenylist;
+    /**
+     * Check dependencies against the allowlist (non-empty allowlist = only listed packages allowed).
+     */
+    private checkAllowlist;
+    /**
+     * Check version ranges for strictness (no ^, ~, *, >= patterns).
+     */
+    private checkVersionRangeStrictness;
+}
+//# sourceMappingURL=dependency-risk-evaluator.d.ts.map

package/dist/packages/core/src/infrastructure/services/security/dependency-risk-evaluator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dependency-risk-evaluator.d.ts","sourceRoot":"","sources":["../../../../../../../packages/core/src/infrastructure/services/security/dependency-risk-evaluator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,OAAO,KAAK,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AAsB9F,qBAAa,uBAAuB;IAClC;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,iBAAiB,EAAE;IAmD7E;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAgB3B;;OAEG;IACH,OAAO,CAAC,wBAAwB;IA0BhC;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAqB/B;;OAEG;IACH,OAAO,CAAC,qBAAqB;IA8C7B;;OAEG;IACH,OAAO,CAAC,aAAa;IAoBrB;;OAEG;IACH,OAAO,CAAC,cAAc;IAoBtB;;OAEG;IACH,OAAO,CAAC,2BAA2B;CAwBpC"}

package/dist/packages/core/src/infrastructure/services/security/dependency-risk-evaluator.js

@@ -0,0 +1,241 @@
+/**
+ * Dependency Risk Evaluator
+ *
+ * Evaluates repository-local dependency risk signals without
+ * external services. Checks:
+ * - Manifest-lockfile consistency (package.json vs lockfile)
+ * - Dependency source types (registry vs git vs file)
+ * - Risky lifecycle scripts (preinstall, postinstall, prepare)
+ * - Allowlist/denylist enforcement
+ * - Version-range strictness
+ *
+ * Returns an array of DependencyFinding objects with severity and remediation.
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { DependencyRiskType, SecuritySeverity } from '../../../domain/generated/output.js';
+/**
+ * Lockfile names in priority order.
+ */
+const LOCKFILE_NAMES = ['pnpm-lock.yaml', 'package-lock.json', 'yarn.lock'];
+/**
+ * Lifecycle script names that execute arbitrary code during install.
+ */
+const RISKY_LIFECYCLE_SCRIPTS = ['preinstall', 'install', 'postinstall', 'prepare'];
+/**
+ * Patterns indicating a non-registry dependency source.
+ */
+const NON_REGISTRY_PREFIXES = ['git+', 'git:', 'github:', 'file:', 'link:', 'http:', 'https:'];
+/**
+ * Patterns indicating loose version ranges.
+ */
+const LOOSE_RANGE_PATTERNS = [/^\*$/, /^\^/, /^~/, /^>=/, /^>(?!=)/];
+export class DependencyRiskEvaluator {
+    /**
+     * Evaluate dependency risk for a repository.
+     *
+     * @param repositoryPath - Absolute path to the repository root
+     * @param rules - Dependency risk policy rules
+     * @returns Array of dependency findings
+     */
+    evaluate(repositoryPath, rules) {
+        const packageJsonPath = join(repositoryPath, 'package.json');
+        if (!existsSync(packageJsonPath)) {
+            return [];
+        }
+        let packageJson;
+        try {
+            packageJson = JSON.parse(readFileSync(packageJsonPath, 'utf-8'));
+        }
+        catch {
+            return [];
+        }
+        const findings = [];
+        // Collect all dependencies
+        const allDeps = this.collectDependencies(packageJson);
+        // Check lockfile consistency
+        if (rules.checkLockfileConsistency) {
+            findings.push(...this.checkLockfileConsistency(repositoryPath, allDeps));
+        }
+        // Check non-registry sources
+        if (rules.checkNonRegistrySource) {
+            findings.push(...this.checkNonRegistrySources(allDeps));
+        }
+        // Check lifecycle scripts
+        if (rules.checkLifecycleScripts) {
+            findings.push(...this.checkLifecycleScripts(repositoryPath, allDeps));
+        }
+        // Check denylist
+        if (rules.denylist.length > 0) {
+            findings.push(...this.checkDenylist(allDeps, rules.denylist));
+        }
+        // Check allowlist
+        if (rules.allowlist.length > 0) {
+            findings.push(...this.checkAllowlist(allDeps, rules.allowlist));
+        }
+        // Check version-range strictness
+        if (rules.enforceStrictVersionRanges) {
+            findings.push(...this.checkVersionRangeStrictness(allDeps));
+        }
+        return findings;
+    }
+    /**
+     * Collect all dependencies from package.json (dependencies + devDependencies).
+     */
+    collectDependencies(packageJson) {
+        const deps = new Map();
+        const depSections = ['dependencies', 'devDependencies'];
+        for (const section of depSections) {
+            const sectionDeps = packageJson[section];
+            if (sectionDeps && typeof sectionDeps === 'object') {
+                for (const [name, version] of Object.entries(sectionDeps)) {
+                    deps.set(name, version);
+                }
+            }
+        }
+        return deps;
+    }
+    /**
+     * Check that a lockfile exists when there are dependencies.
+     */
+    checkLockfileConsistency(repositoryPath, deps) {
+        if (deps.size === 0) {
+            return [];
+        }
+        const hasLockfile = LOCKFILE_NAMES.some((name) => existsSync(join(repositoryPath, name)));
+        if (!hasLockfile) {
+            return [
+                {
+                    packageName: '*',
+                    severity: SecuritySeverity.High,
+                    riskType: DependencyRiskType.LockfileInconsistency,
+                    message: 'No lockfile found. Dependencies are not pinned to specific versions.',
+                    remediation: 'Run your package manager install command to generate a lockfile (e.g., pnpm install).',
+                },
+            ];
+        }
+        return [];
+    }
+    /**
+     * Check for dependencies installed from non-registry sources.
+     */
+    checkNonRegistrySources(deps) {
+        const findings = [];
+        for (const [name, version] of deps) {
+            const isNonRegistry = NON_REGISTRY_PREFIXES.some((prefix) => version.startsWith(prefix));
+            if (isNonRegistry) {
+                findings.push({
+                    packageName: name,
+                    version,
+                    severity: SecuritySeverity.Medium,
+                    riskType: DependencyRiskType.NonRegistrySource,
+                    message: `Package "${name}" is installed from a non-registry source: ${version}`,
+                    remediation: `Consider using a registry-published version of "${name}" instead of a direct source reference.`,
+                });
+            }
+        }
+        return findings;
+    }
+    /**
+     * Check installed packages for risky lifecycle scripts.
+     */
+    checkLifecycleScripts(repositoryPath, deps) {
+        const findings = [];
+        const nodeModules = join(repositoryPath, 'node_modules');
+        if (!existsSync(nodeModules)) {
+            return [];
+        }
+        for (const [name] of deps) {
+            const pkgJsonPath = join(nodeModules, name, 'package.json');
+            if (!existsSync(pkgJsonPath)) {
+                continue;
+            }
+            try {
+                const pkgJson = JSON.parse(readFileSync(pkgJsonPath, 'utf-8'));
+                const scripts = pkgJson.scripts;
+                if (!scripts || typeof scripts !== 'object') {
+                    continue;
+                }
+                const riskyScripts = RISKY_LIFECYCLE_SCRIPTS.filter((s) => typeof scripts[s] === 'string' && scripts[s].length > 0);
+                if (riskyScripts.length > 0) {
+                    findings.push({
+                        packageName: name,
+                        version: pkgJson.version,
+                        severity: SecuritySeverity.Medium,
+                        riskType: DependencyRiskType.LifecycleScript,
+                        message: `Package "${name}" has lifecycle scripts that execute during install: ${riskyScripts.join(', ')}`,
+                        remediation: `Review the lifecycle scripts in "${name}" or add it to the allowlist if trusted. Consider using --ignore-scripts during install.`,
+                    });
+                }
+            }
+            catch {
+                // Skip packages with unreadable package.json
+            }
+        }
+        return findings;
+    }
+    /**
+     * Check dependencies against the denylist.
+     */
+    checkDenylist(deps, denylist) {
+        const findings = [];
+        const denySet = new Set(denylist);
+        for (const [name, version] of deps) {
+            if (denySet.has(name)) {
+                findings.push({
+                    packageName: name,
+                    version,
+                    severity: SecuritySeverity.Critical,
+                    riskType: DependencyRiskType.DenylistViolation,
+                    message: `Package "${name}" is on the denylist and must be removed.`,
+                    remediation: `Remove "${name}" from your dependencies. It has been explicitly denied by security policy.`,
+                });
+            }
+        }
+        return findings;
+    }
+    /**
+     * Check dependencies against the allowlist (non-empty allowlist = only listed packages allowed).
+     */
+    checkAllowlist(deps, allowlist) {
+        const findings = [];
+        const allowSet = new Set(allowlist);
+        for (const [name, version] of deps) {
+            if (!allowSet.has(name)) {
+                findings.push({
+                    packageName: name,
+                    version,
+                    severity: SecuritySeverity.High,
+                    riskType: DependencyRiskType.AllowlistViolation,
+                    message: `Package "${name}" is not on the allowlist.`,
+                    remediation: `Add "${name}" to the allowlist in shep.security.yaml if it is a trusted dependency, or remove it.`,
+                });
+            }
+        }
+        return findings;
+    }
+    /**
+     * Check version ranges for strictness (no ^, ~, *, >= patterns).
+     */
+    checkVersionRangeStrictness(deps) {
+        const findings = [];
+        for (const [name, version] of deps) {
+            // Skip non-registry sources (already flagged separately)
+            if (NON_REGISTRY_PREFIXES.some((prefix) => version.startsWith(prefix))) {
+                continue;
+            }
+            const isLoose = LOOSE_RANGE_PATTERNS.some((pattern) => pattern.test(version));
+            if (isLoose) {
+                findings.push({
+                    packageName: name,
+                    version,
+                    severity: SecuritySeverity.Medium,
+                    riskType: DependencyRiskType.VersionRangePolicy,
+                    message: `Package "${name}" uses a loose version range "${version}". Strict version pinning is required by policy.`,
+                    remediation: `Pin "${name}" to an exact version (e.g., "4.17.21" instead of "${version}").`,
+                });
+            }
+        }
+        return findings;
+    }
+}

package/dist/packages/core/src/infrastructure/services/security/release-integrity-evaluator.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Release Integrity Evaluator
+ *
+ * Checks release pipeline integrity for a repository:
+ * - CI workflow exists and publishes from CI (not local)
+ * - NPM_TOKEN and RELEASE_TOKEN referenced as secrets (not hardcoded)
+ * - npm provenance flags (--provenance) present in publish steps
+ * - Release workflow integrity (semantic-release configured)
+ *
+ * Returns a ReleaseIntegrityResult with individual check results and overall pass/fail.
+ */
+import type { ReleaseIntegrityResult, ReleaseRules } from '../../../domain/generated/output.js';
+export declare class ReleaseIntegrityEvaluator {
+    /**
+     * Evaluate release pipeline integrity.
+     *
+     * @param repositoryPath - Absolute path to the repository root
+     * @param rules - Release integrity policy rules
+     * @returns Aggregated result with individual check details
+     */
+    evaluate(repositoryPath: string, rules: ReleaseRules): ReleaseIntegrityResult;
+    /**
+     * Read all YAML workflow files from .github/workflows/.
+     */
+    private readWorkflowFiles;
+    /**
+     * Check that CI workflow files exist (publishing happens in CI, not locally).
+     */
+    private checkCiOnlyPublishing;
+    /**
+     * Check that tokens are referenced as secrets, not hardcoded.
+     * Scans for known token env var names and verifies they use ${{ secrets.* }}.
+     */
+    private checkSecretConfiguration;
+    /**
+     * Check that npm publish commands include --provenance flag.
+     */
+    private checkProvenanceConfiguration;
+    /**
+     * Check workflow integrity (semantic-release is configured).
+     */
+    private checkWorkflowIntegrity;
+}
+//# sourceMappingURL=release-integrity-evaluator.d.ts.map

package/dist/packages/core/src/infrastructure/services/security/release-integrity-evaluator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-integrity-evaluator.d.ts","sourceRoot":"","sources":["../../../../../../../packages/core/src/infrastructure/services/security/release-integrity-evaluator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAKH,OAAO,KAAK,EAEV,sBAAsB,EACtB,YAAY,EACb,MAAM,qCAAqC,CAAC;AA2B7C,qBAAa,yBAAyB;IACpC;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,sBAAsB;IAiC7E;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAgBzB;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAsB7B;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IAkChC;;OAEG;IACH,OAAO,CAAC,4BAA4B;IAyCpC;;OAEG;IACH,OAAO,CAAC,sBAAsB;CAoB/B"}