@skaleagents/swarm 0.6.8 → 0.6.10

package/dist/iac/parse.d.ts

@@ -1,4 +1,4 @@
-export type IacFormat = "terraform" | "cloudformation" | "kubernetes" | "pulumi" | "compose";
+export type IacFormat = "terraform" | "cloudformation" | "kubernetes" | "pulumi" | "compose" | "dockerfile" | "github" | "helm" | "ansible";
 export type Path = (string | number)[];
 export type Location = {
     line: number;
@@ -24,5 +24,9 @@ export declare function array(value: unknown): unknown[];
 export declare function looksLikeIac(content: string): boolean;
 export declare function looksLikePulumiProgram(content: string): boolean;
 export declare function looksLikeCompose(content: string): boolean;
+export declare function looksLikeDockerfile(content: string): boolean;
+export declare function looksLikeAnsible(content: string): boolean;
+export declare function looksLikeHelm(content: string): boolean;
+export declare function looksLikeGithubWorkflow(content: string): boolean;
 export declare function looksLikePulumiYaml(content: string): boolean;
 export declare function parseIac(content: string, requested?: IacFormat | "auto"): ParsedIac;

package/dist/iac/parse.js

@@ -40,7 +40,11 @@ export function looksLikeIac(content) {
         /^\s*\{\s*"(?:resource|Resources|apiVersion|AWSTemplateFormatVersion)"\s*:/.test(content) ||
         looksLikePulumiYaml(content) ||
         looksLikePulumiProgram(content) ||
-        looksLikeCompose(content));
+        looksLikeCompose(content) ||
+        looksLikeDockerfile(content) ||
+        looksLikeGithubWorkflow(content) ||
+        looksLikeHelm(content) ||
+        looksLikeAnsible(content));
 }
 export function looksLikePulumiProgram(content) {
     return /(?:^|\n)\s*(?:import\s+\*\s+as\s+pulumi\b|import\s+pulumi\b|from\s+["']@pulumi\/)/.test(content);
@@ -48,6 +52,43 @@ export function looksLikePulumiProgram(content) {
 export function looksLikeCompose(content) {
     return /^\s*services\s*:/m.test(content) && /^\s+image\s*:/m.test(content);
 }
+export function looksLikeDockerfile(content) {
+    return /^\s*FROM\s+\S+/m.test(content);
+}
+function topLevelKey(content, name) {
+    return new RegExp(`^(?:"${name}"|'${name}'|${name})\\s*:`, "m").test(content);
+}
+function playbookShape(content) {
+    if (topLevelKey(content, "hosts") && topLevelKey(content, "tasks"))
+        return true;
+    return /^\s*-\s+hosts\s*:/m.test(content) && /^\s*tasks\s*:/m.test(content);
+}
+export function looksLikeAnsible(content) {
+    if (looksLikeGithubWorkflow(content))
+        return false;
+    if (topLevelKey(content, "apiVersion") && topLevelKey(content, "kind"))
+        return false;
+    return playbookShape(content);
+}
+export function looksLikeHelm(content) {
+    if (looksLikeGithubWorkflow(content) || looksLikeAnsible(content))
+        return false;
+    const visible = maskNonCode(content);
+    if (!visible.includes("{{"))
+        return false;
+    return /^\s*(?:apiVersion|kind)\s*:/m.test(visible);
+}
+export function looksLikeGithubWorkflow(content) {
+    if (topLevelKey(content, "apiVersion") || topLevelKey(content, "kind"))
+        return false;
+    const topOn = topLevelKey(content, "on");
+    const composeOnly = topLevelKey(content, "services") &&
+        /^\s+image\s*:/m.test(content) &&
+        !topOn;
+    if (composeOnly)
+        return false;
+    return topOn && topLevelKey(content, "jobs");
+}
 export function looksLikePulumiYaml(content) {
     return (/^\s*resources\s*:/m.test(content) &&
         /^\s+type\s*:\s*[A-Za-z0-9_.-]+:\S+/m.test(content));
@@ -55,6 +96,24 @@ export function looksLikePulumiYaml(content) {
 export function parseIac(content, requested = "auto") {
     if (!content.trim())
         throw new ScanInputError("Content must not be empty or whitespace.");
+    // Detect these before HCL or a failing YAML parse so a Dockerfile is not classified as Terraform.
+    if (requested === "dockerfile" ||
+        ((requested === "auto" || requested === "terraform") &&
+            looksLikeDockerfile(content))) {
+        return parseDockerfile(content);
+    }
+    if (requested === "github" ||
+        (requested === "auto" && looksLikeGithubWorkflow(content))) {
+        return parseGithubWorkflow(content);
+    }
+    if (requested === "ansible" ||
+        (requested === "auto" && looksLikeAnsible(content))) {
+        return parseAnsible(content);
+    }
+    if (requested === "helm" ||
+        (requested === "auto" && looksLikeHelm(content))) {
+        return parseHelm(content);
+    }
     if (requested !== "terraform" &&
         requested !== "compose" &&
         looksLikePulumiProgram(content) &&
@@ -271,7 +330,7 @@ export function parseIac(content, requested = "auto") {
         }
     }
     if (!format)
-        throw new ScanInputError("No IaC document found. Choose Terraform, CloudFormation, Kubernetes, Pulumi, or Docker Compose.");
+        throw new ScanInputError("No IaC document found. Choose Terraform, CloudFormation, Kubernetes, Pulumi, Docker Compose, a Dockerfile, a GitHub Actions workflow, a Helm template, or an Ansible playbook.");
     if (!resources.length)
         warnings.push("No resources found in the submitted document.");
     if (/(?:!(?:Ref|Sub|GetAtt|If)\b|"(?:Ref|Fn::\w+)"\s*:|\$\{)/.test(content))
@@ -352,6 +411,309 @@ function parsePulumiProgram(content) {
         ],
     };
 }
+const submittedTextWarning = "The scan reads the submitted text and does not execute the image or the workflow.";
+function logicalDockerfileLines(content) {
+    const raw = content.split(/\r?\n/);
+    const lines = [];
+    let buffer = "";
+    let start = 1;
+    for (let index = 0; index < raw.length; index++) {
+        const current = raw[index].replace(/\s+$/, "");
+        if (!buffer)
+            start = index + 1;
+        if (current.endsWith("\\")) {
+            buffer += `${current.slice(0, -1)} `;
+            continue;
+        }
+        buffer += current;
+        const text = buffer.trim();
+        buffer = "";
+        if (!text || text.startsWith("#"))
+            continue;
+        lines.push({ line: start, text });
+    }
+    return lines;
+}
+function parseFromInstruction(text) {
+    if (!/^FROM\b/i.test(text))
+        return undefined;
+    const parts = text.split(/\s+/);
+    let index = 1;
+    while (index < parts.length && parts[index].startsWith("--")) {
+        if (!parts[index].includes("="))
+            index += 1;
+        index += 1;
+    }
+    const image = parts[index];
+    if (!image)
+        return undefined;
+    const stage = /^as$/i.test(parts[index + 1] ?? "")
+        ? parts[index + 2]
+        : undefined;
+    return stage ? { image, stage } : { image };
+}
+function imageIsUnpinned(image, stages) {
+    if (image.includes("${") ||
+        image.includes("@") ||
+        stages.has(image) ||
+        stages.has(image.toLowerCase()) ||
+        image.toLowerCase() === "scratch")
+        return false;
+    const slash = image.lastIndexOf("/");
+    const colon = image.lastIndexOf(":");
+    if (colon <= slash)
+        return true;
+    return image.slice(colon + 1) === "latest";
+}
+function parseUserName(text) {
+    if (!/^USER\b/i.test(text))
+        return undefined;
+    const parts = text
+        .split(/\s+/)
+        .slice(1)
+        .filter((part) => part && !part.startsWith("--"));
+    const raw = parts[0];
+    if (!raw)
+        return undefined;
+    return raw.replace(/^["']|["']$/g, "").split(":")[0];
+}
+function runPipesToShell(text) {
+    return (/^RUN\b/i.test(text) &&
+        /\b(?:curl|wget)\b/i.test(text) &&
+        /\|\s*(?:sudo\s+)?(?:\S*\/)?(?:ba)?sh\b/i.test(text));
+}
+function copySources(text) {
+    if (!/^(?:COPY|ADD)\b/i.test(text))
+        return undefined;
+    const rest = text.replace(/^(?:COPY|ADD)\b/i, "").trim();
+    if (rest.startsWith("[")) {
+        try {
+            const parsed = JSON.parse(rest);
+            if (!Array.isArray(parsed) || parsed.length < 2)
+                return [];
+            return parsed.slice(0, -1).map((item) => String(item));
+        }
+        catch {
+            return [];
+        }
+    }
+    const tokens = [];
+    for (const match of rest.matchAll(/"([^"]*)"|'([^']*)'|(\S+)/g)) {
+        const token = match[1] ?? match[2] ?? match[3];
+        if (token.startsWith("--"))
+            continue;
+        tokens.push(token);
+    }
+    if (tokens.length < 2)
+        return [];
+    return tokens.slice(0, -1);
+}
+function sourceIsSecret(source) {
+    const path = source.replace(/\\/g, "/").replace(/\/+$/, "");
+    const base = path.split("/").filter(Boolean).at(-1) ?? path;
+    if (base === ".env" || base === "id_rsa" || base === "id_ed25519")
+        return true;
+    if (base.endsWith(".pem"))
+        return true;
+    return base === "credentials";
+}
+function lineLocation(line, path) {
+    return { line, column: 1, path };
+}
+function parseDockerfile(content) {
+    const instructions = logicalDockerfileLines(content);
+    const froms = instructions.flatMap((instruction) => {
+        const parsed = parseFromInstruction(instruction.text);
+        return parsed ? [{ ...instruction, ...parsed }] : [];
+    });
+    if (!froms.length)
+        throw new ScanInputError("A Dockerfile requires a FROM instruction.");
+    const stages = new Set();
+    const resources = [];
+    froms.forEach((from, index) => {
+        resources.push({
+            id: `dockerfile.from.${index + 1}`,
+            type: "dockerfile:from",
+            value: { image: from.image, unpinned: imageIsUnpinned(from.image, stages) },
+            locate: () => lineLocation(from.line, "image"),
+        });
+        if (from.stage) {
+            stages.add(from.stage);
+            stages.add(from.stage.toLowerCase());
+        }
+    });
+    let lastUser;
+    for (const instruction of instructions) {
+        const name = parseUserName(instruction.text);
+        if (name !== undefined)
+            lastUser = { line: instruction.line, name };
+    }
+    const root = !lastUser || lastUser.name.toLowerCase() === "root" || lastUser.name === "0";
+    resources.push({
+        id: "dockerfile.user",
+        type: "dockerfile:user",
+        value: { user: lastUser?.name ?? "", root },
+        locate: () => lineLocation(lastUser?.line ?? froms[0].line, "user"),
+    });
+    instructions.forEach((instruction, index) => {
+        if (!/^RUN\b/i.test(instruction.text))
+            return;
+        resources.push({
+            id: `dockerfile.run.${index + 1}`,
+            type: "dockerfile:run",
+            value: { piped: runPipesToShell(instruction.text) },
+            locate: () => lineLocation(instruction.line, "run"),
+        });
+    });
+    instructions.forEach((instruction, index) => {
+        const sources = copySources(instruction.text);
+        if (!sources)
+            return;
+        resources.push({
+            id: `dockerfile.copy.${index + 1}`,
+            type: "dockerfile:copy",
+            value: { secret: sources.some(sourceIsSecret) },
+            locate: () => lineLocation(instruction.line, "copy"),
+        });
+    });
+    return {
+        format: "dockerfile",
+        resources,
+        warnings: [submittedTextWarning],
+    };
+}
+function triggersPullRequestTarget(value) {
+    if (value === "pull_request_target")
+        return true;
+    if (Array.isArray(value))
+        return value.some((item) => item === "pull_request_target");
+    return Object.prototype.hasOwnProperty.call(object(value), "pull_request_target");
+}
+function workflowChecksOutHead(jobs) {
+    for (const job of Object.values(object(jobs))) {
+        for (const step of array(object(job).steps)) {
+            const inputs = object(object(step).with);
+            const text = [inputs.ref, inputs.sha]
+                .filter((item) => typeof item === "string")
+                .join("\n");
+            if (text.includes("github.event.pull_request.head"))
+                return true;
+        }
+    }
+    return false;
+}
+function runPrintsSecret(script) {
+    const logical = script.replace(/\\\r?\n\s*/g, " ");
+    return logical.split(/\n/).some((line) => {
+        const code = line.replace(/(^|\s)#[^\n]*$/, "");
+        return (/\b(?:echo|printf|print)\b/i.test(code) &&
+            /\$\{\{\s*secrets\./.test(code));
+    });
+}
+function permissionsAreBroad(top, jobs, pullRequestTarget) {
+    const values = [
+        top,
+        ...Object.values(object(jobs)).map((job) => object(job).permissions),
+    ];
+    if (values.some((value) => value === "write-all"))
+        return true;
+    if (!pullRequestTarget)
+        return false;
+    return values.some((value) => object(value).contents === "write");
+}
+function parseGithubWorkflow(content) {
+    const lines = new LineCounter();
+    let documents;
+    try {
+        documents = parseAllDocuments(content, {
+            lineCounter: lines,
+            prettyErrors: false,
+        });
+    }
+    catch {
+        throw new ScanInputError("Invalid GitHub Actions workflow YAML.");
+    }
+    const resources = [];
+    let found = false;
+    for (const [documentIndex, doc] of documents.entries()) {
+        if (doc.errors.length)
+            throw new ScanInputError("Invalid GitHub Actions workflow YAML.");
+        let data;
+        try {
+            data = doc.toJS({ maxAliasCount: 0 });
+        }
+        catch {
+            throw new ScanInputError("YAML aliases are not supported. Expand anchors before scanning.");
+        }
+        if (data == null)
+            continue;
+        checkShape(data);
+        const root = object(data);
+        if (!("on" in root) || !("jobs" in root))
+            continue;
+        found = true;
+        const pullRequestTarget = triggersPullRequestTarget(root.on);
+        const checksOutHead = workflowChecksOutHead(root.jobs);
+        const broad = permissionsAreBroad(root.permissions, root.jobs, pullRequestTarget);
+        const position = (path) => {
+            let node = doc.getIn(path, true);
+            if (!node?.range)
+                node = doc.getIn(["on"], true);
+            const at = lines.linePos(node?.range?.[0] ?? doc.range?.[0] ?? 0);
+            return {
+                line: at.line,
+                column: at.col,
+                path: [documentIndex, ...path].join("."),
+            };
+        };
+        resources.push({
+            id: "workflow.on",
+            type: "github:trigger",
+            value: { pullRequestTarget, checksOutHead },
+            locate: () => position(["on"]),
+        });
+        resources.push({
+            id: "workflow.permissions",
+            type: "github:permissions",
+            value: { broad },
+            locate: () => position(root.permissions != null ? ["permissions"] : ["on"]),
+        });
+        for (const [jobName, job] of Object.entries(object(root.jobs))) {
+            array(object(job).steps).forEach((step, index) => {
+                const uses = object(step).uses;
+                if (typeof uses !== "string")
+                    return;
+                const ref = uses.includes("@")
+                    ? uses.slice(uses.lastIndexOf("@") + 1)
+                    : "";
+                resources.push({
+                    id: `jobs.${jobName}.steps.${index}`,
+                    type: "github:action",
+                    value: { uses, floating: ref === "main" || ref === "master" },
+                    locate: () => position(["jobs", jobName, "steps", index, "uses"]),
+                });
+            });
+            array(object(job).steps).forEach((step, index) => {
+                const run = object(step).run;
+                if (typeof run !== "string")
+                    return;
+                resources.push({
+                    id: `jobs.${jobName}.steps.${index}.run`,
+                    type: "github:run",
+                    value: { printsSecret: runPrintsSecret(run) },
+                    locate: () => position(["jobs", jobName, "steps", index, "run"]),
+                });
+            });
+        }
+    }
+    if (!found)
+        throw new ScanInputError("A GitHub Actions workflow requires top-level on and jobs keys.");
+    return {
+        format: "github",
+        resources,
+        warnings: [submittedTextWarning],
+    };
+}
 function composeServiceMap(root) {
     if (root.apiVersion || root.kind || root.Resources || root.resources)
         return undefined;
@@ -382,3 +744,95 @@ function pulumiResourceMap(root) {
 function escapeRegex(value) {
     return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
+function maskNonCode(content) {
+    const withoutBlockComments = content
+        .replace(/\{\{-?\s*\/\*[\s\S]*?\*\/\s*-?\}\}/g, (match) => match.replace(/[^\n]/g, " "))
+        .replace(/\{#[\s\S]*?#\}/g, (match) => match.replace(/[^\n]/g, " "));
+    return withoutBlockComments
+        .split("\n")
+        .map((line) => {
+        let out = "";
+        let templates = 0;
+        let quote;
+        for (let index = 0; index < line.length; index++) {
+            const char = line[index];
+            const next = line[index + 1];
+            if (quote) {
+                out += char;
+                if (char === quote && line[index - 1] !== "\\")
+                    quote = undefined;
+                continue;
+            }
+            if (templates === 0 && (char === '"' || char === "'")) {
+                quote = char;
+                out += char;
+                continue;
+            }
+            if (char === "{" && next === "{") {
+                templates += 1;
+                out += char;
+                continue;
+            }
+            if (char === "}" && next === "}" && templates > 0) {
+                templates -= 1;
+                out += char;
+                continue;
+            }
+            if (templates === 0 && char === "#") {
+                return out + " ".repeat(line.length - out.length);
+            }
+            out += char;
+        }
+        return out;
+    })
+        .join("\n");
+}
+function lineAt(content, index) {
+    return content.slice(0, index).split("\n").length;
+}
+function firstLiteral(content, pattern) {
+    const match = pattern.exec(content);
+    if (!match || match.index === undefined)
+        return { present: false, line: 1 };
+    return { present: true, line: lineAt(content, match.index) };
+}
+function literalResource(id, type, match, path) {
+    return {
+        id,
+        type,
+        value: { present: match.present },
+        locate: () => lineLocation(match.line, path),
+    };
+}
+const helmTemplateWarning = "Helm templates are not executed. Only literal text outside comments is checked.";
+const ansibleFactsWarning = "Ansible facts are not executed. Only literal text outside comments is checked.";
+function parseHelm(content) {
+    const visible = maskNonCode(content);
+    const privileged = firstLiteral(visible, /privileged\s*:\s*["']?true["']?\b/);
+    const hostNetwork = firstLiteral(visible, /hostNetwork\s*:\s*["']?true["']?\b/);
+    const latest = firstLiteral(visible, /:latest\b/);
+    const socket = firstLiteral(visible, /(?:hostPath|volumes?)\b[\s\S]{0,500}docker\.sock|docker\.sock[\s\S]{0,200}\b(?:hostPath|volumes?)\b/);
+    return {
+        format: "helm",
+        resources: [
+            literalResource("helm.privileged", "helm:privileged", privileged, "privileged"),
+            literalResource("helm.hostNetwork", "helm:hostNetwork", hostNetwork, "hostNetwork"),
+            literalResource("helm.image", "helm:image", latest, "image"),
+            literalResource("helm.socket", "helm:socket", socket, "volume"),
+        ],
+        warnings: [helmTemplateWarning],
+    };
+}
+function parseAnsible(content) {
+    const visible = maskNonCode(content);
+    const become = firstLiteral(visible, /(?:^|\n)\s*(?:-\s+)?become\s*:\s*["']?(?:true|yes)["']?(?=\s|$)/);
+    const cidr = firstLiteral(visible, /(?:cidr|source)\s*:\s*(?:\|\s*)?(?:\n\s*-\s*)?["']?0\.0\.0\.0\/0\b/);
+    return {
+        format: "ansible",
+        resources: [
+            literalResource("ansible.become", "ansible:become", become, "become"),
+            literalResource("ansible.cidr", "ansible:cidr", cidr, "cidr"),
+        ],
+        warnings: [ansibleFactsWarning],
+    };
+}

package/dist/iac/rules.js

@@ -197,6 +197,104 @@ export const rules = {
         detail: "A role grants wildcard verbs, resources, or API groups.",
         remediation: "Scope the role to the required API groups, resource names, and verbs.",
     },
+    DF001: {
+        category: "security",
+        severity: "high",
+        title: "Dockerfile runs as root",
+        detail: "The last USER is root or 0, or the Dockerfile has no USER instruction.",
+        remediation: "Add a final USER instruction for a non-root account that the image supports.",
+    },
+    DF002: {
+        category: "security",
+        severity: "medium",
+        title: "Unpinned container image",
+        detail: "A FROM image uses the latest tag, or it has no tag and no digest.",
+        remediation: "Pin a release tag or an image digest. Scratch and named stages are not image pins.",
+    },
+    DF003: {
+        category: "security",
+        severity: "high",
+        title: "Remote script piped to a shell",
+        detail: "A RUN instruction downloads a script with curl or wget and pipes it to sh or bash.",
+        remediation: "Download the script, review it, and pin a checksum before running it. Do not pipe a remote script to a shell.",
+    },
+    GH001: {
+        category: "security",
+        severity: "critical",
+        title: "Pull request target checks out PR code",
+        detail: "The workflow triggers on pull_request_target and checks out the pull request head ref or head sha.",
+        remediation: "Avoid checking out pull request head code from pull_request_target. Use pull_request for untrusted code, or check out the base repository only.",
+    },
+    GH002: {
+        category: "security",
+        severity: "high",
+        title: "Workflow permissions are broad",
+        detail: "permissions is write-all, or a pull_request_target workflow sets contents to write.",
+        remediation: "Set the narrowest permissions the workflow needs. Keep contents read-only on pull_request_target.",
+    },
+    GH003: {
+        category: "security",
+        severity: "medium",
+        title: "Action ref is a floating branch",
+        detail: "A uses value is pinned to @main or @master.",
+        remediation: "Pin the action to a release tag or a full commit SHA.",
+    },
+    DF004: {
+        category: "security",
+        severity: "high",
+        title: "Secret file copied into the image",
+        detail: "A COPY or ADD instruction uses a secret file as a source.",
+        remediation: "Keep secret files out of the image. Mount them at runtime from a secret store.",
+    },
+    GH004: {
+        category: "security",
+        severity: "high",
+        title: "Workflow prints a secret",
+        detail: "A run script echoes or prints a secrets expression.",
+        remediation: "Remove the printed secret from the script. Pass secrets through an environment variable that the step does not print.",
+    },
+    HELM001: {
+        category: "security",
+        severity: "critical",
+        title: "Privileged container in a Helm template",
+        detail: "The template sets privileged to true.",
+        remediation: "Set privileged to false. Isolate workloads that genuinely require elevated privileges.",
+    },
+    HELM002: {
+        category: "security",
+        severity: "high",
+        title: "Host network in a Helm template",
+        detail: "The template sets hostNetwork to true.",
+        remediation: "Disable hostNetwork unless a reviewed node-level component requires it.",
+    },
+    HELM003: {
+        category: "reliability",
+        severity: "medium",
+        title: "Unpinned image in a Helm template",
+        detail: "An image tag uses latest.",
+        remediation: "Pin an immutable digest or a release tag.",
+    },
+    HELM004: {
+        category: "security",
+        severity: "high",
+        title: "Docker socket mounted in a Helm template",
+        detail: "A hostPath or volume contains docker.sock.",
+        remediation: "Remove the Docker socket mount. Use a scoped volume or a reviewed runtime API instead.",
+    },
+    ANS001: {
+        category: "security",
+        severity: "high",
+        title: "Ansible task runs as root",
+        detail: "A play or task sets become to true or yes.",
+        remediation: "Set become to false unless the task has a reviewed need to run as root.",
+    },
+    ANS002: {
+        category: "security",
+        severity: "high",
+        title: "Broad network exposure",
+        detail: "A cidr or source allows 0.0.0.0/0.",
+        remediation: "Restrict the cidr or source to approved addresses.",
+    },
 };
 export function resourceFindings(resources, format) {
     const findings = [];
@@ -212,6 +310,22 @@ export function resourceFindings(resources, format) {
                     location: resource.locate(path),
                 });
         };
+        if (format === "dockerfile") {
+            checkDockerfile(resource, check);
+            continue;
+        }
+        if (format === "github") {
+            checkGithub(resource, check);
+            continue;
+        }
+        if (format === "helm") {
+            checkHelm(resource, check);
+            continue;
+        }
+        if (format === "ansible") {
+            checkAnsible(resource, check);
+            continue;
+        }
         walk(resource.value, (key, value, path, parent) => {
             if (typeof value !== "string")
                 return;
@@ -232,6 +346,43 @@ export function resourceFindings(resources, format) {
     }
     return { findings, checked };
 }
+function checkDockerfile(resource, check) {
+    if (resource.type === "dockerfile:user")
+        check("DF001", resource.value.root === true, ["user"]);
+    else if (resource.type === "dockerfile:from")
+        check("DF002", resource.value.unpinned === true, ["image"]);
+    else if (resource.type === "dockerfile:run")
+        check("DF003", resource.value.piped === true, ["run"]);
+    else if (resource.type === "dockerfile:copy")
+        check("DF004", resource.value.secret === true, ["copy"]);
+}
+function checkGithub(resource, check) {
+    if (resource.type === "github:trigger")
+        check("GH001", resource.value.pullRequestTarget === true &&
+            resource.value.checksOutHead === true, ["on"]);
+    else if (resource.type === "github:permissions")
+        check("GH002", resource.value.broad === true, ["permissions"]);
+    else if (resource.type === "github:action")
+        check("GH003", resource.value.floating === true, ["uses"]);
+    else if (resource.type === "github:run")
+        check("GH004", resource.value.printsSecret === true, ["run"]);
+}
+function checkHelm(resource, check) {
+    if (resource.type === "helm:privileged")
+        check("HELM001", resource.value.present === true, ["privileged"]);
+    else if (resource.type === "helm:hostNetwork")
+        check("HELM002", resource.value.present === true, ["hostNetwork"]);
+    else if (resource.type === "helm:image")
+        check("HELM003", resource.value.present === true, ["image"]);
+    else if (resource.type === "helm:socket")
+        check("HELM004", resource.value.present === true, ["volume"]);
+}
+function checkAnsible(resource, check) {
+    if (resource.type === "ansible:become")
+        check("ANS001", resource.value.present === true, ["become"]);
+    else if (resource.type === "ansible:cidr")
+        check("ANS002", resource.value.present === true, ["cidr"]);
+}
 function walk(value, visit, path = []) {
     if (Array.isArray(value))
         value.forEach((child, index) => walk(child, visit, [...path, index]));

package/dist/server.js

@@ -73,12 +73,16 @@ export function createServer(remote = false) {
                 "kubernetes",
                 "pulumi",
                 "compose",
+                "dockerfile",
+                "github",
+                "helm",
+                "ansible",
                 "application",
                 "auto",
             ])
                 .optional()
                 .default("auto")
-                .describe("Content format: terraform, cloudformation, kubernetes, pulumi, compose, application, auto"),
+                .describe("Content format: terraform, cloudformation, kubernetes, pulumi, compose, dockerfile, github, helm, ansible, application, auto."),
         },
     }, async ({ content, focus, format, minSeverity, maxFindings }) => {
         const botHints = fetchPublicBotHints();
@@ -126,7 +130,7 @@ export function createServer(remote = false) {
             description: (name === "scan_iac_stub"
                 ? "Compatibility alias for scan_iac; runs the full scanner. "
                 : "") +
-                "Parse Terraform HCL/JSON, CloudFormation YAML/JSON, Kubernetes manifests, Pulumi YAML, Pulumi programs, or Docker Compose. Check security, reliability and cost rules with resource locations and remediation. Pulumi programs are scanned as text.",
+                "Parse Terraform HCL/JSON, CloudFormation YAML/JSON, Kubernetes manifests, Pulumi YAML, Pulumi programs, or Docker Compose. Includes Dockerfile, GitHub Actions, Helm templates, and Ansible playbooks. Helm templates and Ansible facts are not executed. Check security, reliability and cost rules with resource locations and remediation. Pulumi programs are scanned as text.",
             annotations: {
                 readOnlyHint: true,
                 destructiveHint: false,
@@ -134,7 +138,7 @@ export function createServer(remote = false) {
             },
             _meta: { securitySchemes: [{ type: "oauth2", scopes: ["mcp"] }] },
             inputSchema: {
-                content: contentSchema.describe("Terraform HCL/JSON, CloudFormation YAML/JSON, Kubernetes YAML/JSON, Pulumi YAML or program text, or Docker Compose"),
+                content: contentSchema.describe("Terraform HCL/JSON, CloudFormation YAML/JSON, Kubernetes YAML/JSON, Pulumi YAML or program text, or Docker Compose. Includes Dockerfile, GitHub Actions, Helm templates, and Ansible playbooks."),
                 format: z
                     .enum([
                     "terraform",
@@ -142,6 +146,10 @@ export function createServer(remote = false) {
                     "kubernetes",
                     "pulumi",
                     "compose",
+                    "dockerfile",
+                    "github",
+                    "helm",
+                    "ansible",
                     "auto",
                 ])
                     .default("auto"),

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const VERSION = "0.6.8";
+export declare const VERSION = "0.6.10";

package/dist/version.js

@@ -1 +1 @@
-export const VERSION = "0.6.8";
+export const VERSION = "0.6.10";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skaleagents/swarm",
-  "version": "0.6.8",
+  "version": "0.6.10",
   "private": false,
   "publishConfig": {
     "access": "public"