@skaleagents/swarm 0.6.9 → 0.6.11

package/README.md

@@ -62,7 +62,9 @@ review-brief builder.
 ## Infrastructure scanning
 
 `scan_iac` parses Terraform HCL/JSON, CloudFormation YAML/JSON, and Kubernetes
-manifests, including multi-document YAML and Kubernetes Lists. It returns a
+manifests, including multi-document YAML and Kubernetes Lists. It also reads
+Dockerfiles, GitHub Actions workflows, Helm templates, Ansible playbooks,
+Bicep files, and ARM templates. It returns a
 resource inventory and findings with stable rule IDs, severity, property paths,
 line locations, and remediation. Findings never include matched secret values.
 

package/dist/iac/parse.d.ts

@@ -1,4 +1,4 @@
-export type IacFormat = "terraform" | "cloudformation" | "kubernetes" | "pulumi" | "compose" | "dockerfile" | "github";
+export type IacFormat = "terraform" | "cloudformation" | "kubernetes" | "pulumi" | "compose" | "dockerfile" | "github" | "helm" | "ansible" | "bicep" | "arm";
 export type Path = (string | number)[];
 export type Location = {
     line: number;
@@ -25,6 +25,11 @@ export declare function looksLikeIac(content: string): boolean;
 export declare function looksLikePulumiProgram(content: string): boolean;
 export declare function looksLikeCompose(content: string): boolean;
 export declare function looksLikeDockerfile(content: string): boolean;
+export declare function looksLikeAnsible(content: string): boolean;
+export declare function looksLikeHelm(content: string): boolean;
 export declare function looksLikeGithubWorkflow(content: string): boolean;
+export declare function looksLikeTerraformHcl(content: string): boolean;
+export declare function looksLikeBicep(content: string): boolean;
+export declare function looksLikeArm(content: string): boolean;
 export declare function looksLikePulumiYaml(content: string): boolean;
 export declare function parseIac(content: string, requested?: IacFormat | "auto"): ParsedIac;

package/dist/iac/parse.js

@@ -42,7 +42,11 @@ export function looksLikeIac(content) {
         looksLikePulumiProgram(content) ||
         looksLikeCompose(content) ||
         looksLikeDockerfile(content) ||
-        looksLikeGithubWorkflow(content));
+        looksLikeGithubWorkflow(content) ||
+        looksLikeHelm(content) ||
+        looksLikeAnsible(content) ||
+        looksLikeBicep(content) ||
+        looksLikeArm(content));
 }
 export function looksLikePulumiProgram(content) {
     return /(?:^|\n)\s*(?:import\s+\*\s+as\s+pulumi\b|import\s+pulumi\b|from\s+["']@pulumi\/)/.test(content);
@@ -56,6 +60,26 @@ export function looksLikeDockerfile(content) {
 function topLevelKey(content, name) {
     return new RegExp(`^(?:"${name}"|'${name}'|${name})\\s*:`, "m").test(content);
 }
+function playbookShape(content) {
+    if (topLevelKey(content, "hosts") && topLevelKey(content, "tasks"))
+        return true;
+    return /^\s*-\s+hosts\s*:/m.test(content) && /^\s*tasks\s*:/m.test(content);
+}
+export function looksLikeAnsible(content) {
+    if (looksLikeGithubWorkflow(content))
+        return false;
+    if (topLevelKey(content, "apiVersion") && topLevelKey(content, "kind"))
+        return false;
+    return playbookShape(content);
+}
+export function looksLikeHelm(content) {
+    if (looksLikeGithubWorkflow(content) || looksLikeAnsible(content))
+        return false;
+    const visible = maskNonCode(content);
+    if (!visible.includes("{{"))
+        return false;
+    return /^\s*(?:apiVersion|kind)\s*:/m.test(visible);
+}
 export function looksLikeGithubWorkflow(content) {
     if (topLevelKey(content, "apiVersion") || topLevelKey(content, "kind"))
         return false;
@@ -67,6 +91,44 @@ export function looksLikeGithubWorkflow(content) {
         return false;
     return topOn && topLevelKey(content, "jobs");
 }
+export function looksLikeTerraformHcl(content) {
+    return /^\s*(?:(?:resource|module|variable|provider|data|output)\s+"|(?:terraform|locals)\s*\{)/m.test(content);
+}
+export function looksLikeBicep(content) {
+    const visible = maskIaCComments(content);
+    if (looksLikeTerraformHcl(visible))
+        return false;
+    return /^\s*resource\s+[A-Za-z_][A-Za-z0-9_]*\s+['"]Microsoft\./m.test(visible);
+}
+export function looksLikeArm(content) {
+    const visible = maskIaCComments(content).trim();
+    if (!visible.startsWith("{"))
+        return false;
+    let value;
+    try {
+        value = JSON.parse(visible);
+    }
+    catch {
+        return false;
+    }
+    const root = object(value);
+    if (typeof root.AWSTemplateFormatVersion === "string")
+        return false;
+    if (Object.values(object(root.Resources)).some((item) => String(object(item).Type ?? "").startsWith("AWS::")))
+        return false;
+    if ("resource" in root && !Array.isArray(root.resources))
+        return false;
+    if ("format_version" in root ||
+        "planned_values" in root ||
+        "resource_changes" in root)
+        return false;
+    if (typeof root.$schema === "string" &&
+        root.$schema.includes("deploymentTemplate"))
+        return true;
+    if (typeof root.contentVersion !== "string" || !Array.isArray(root.resources))
+        return false;
+    return root.resources.some((item) => String(object(item).type ?? "").startsWith("Microsoft."));
+}
 export function looksLikePulumiYaml(content) {
     return (/^\s*resources\s*:/m.test(content) &&
         /^\s+type\s*:\s*[A-Za-z0-9_.-]+:\S+/m.test(content));
@@ -84,6 +146,24 @@ export function parseIac(content, requested = "auto") {
         (requested === "auto" && looksLikeGithubWorkflow(content))) {
         return parseGithubWorkflow(content);
     }
+    if (requested === "ansible" ||
+        (requested === "auto" && looksLikeAnsible(content))) {
+        return parseAnsible(content);
+    }
+    if (requested === "helm" ||
+        (requested === "auto" && looksLikeHelm(content))) {
+        return parseHelm(content);
+    }
+    if (requested === "bicep" || (requested === "auto" && looksLikeBicep(content))) {
+        if (!looksLikeBicep(content))
+            throw new ScanInputError("A Bicep file requires a Microsoft resource declaration.");
+        return parseAzure(content, "bicep");
+    }
+    if (requested === "arm" || (requested === "auto" && looksLikeArm(content))) {
+        if (!looksLikeArm(content))
+            throw new ScanInputError("An ARM template requires a deploymentTemplate schema or contentVersion with Microsoft resources.");
+        return parseAzure(content, "arm");
+    }
     if (requested !== "terraform" &&
         requested !== "compose" &&
         looksLikePulumiProgram(content) &&
@@ -93,8 +173,7 @@ export function parseIac(content, requested = "auto") {
     const warnings = [];
     const resources = [];
     const isHcl = (requested === "terraform" && !content.trimStart().startsWith("{")) ||
-        (requested === "auto" &&
-            /^\s*(?:(?:resource|module|variable|provider|data|output)\s+"|(?:terraform|locals)\s*\{)/m.test(content));
+        (requested === "auto" && looksLikeTerraformHcl(content));
     if (isHcl) {
         let data;
         try {
@@ -300,7 +379,7 @@ export function parseIac(content, requested = "auto") {
         }
     }
     if (!format)
-        throw new ScanInputError("No IaC document found. Choose Terraform, CloudFormation, Kubernetes, Pulumi, Docker Compose, a Dockerfile, or a GitHub Actions workflow.");
+        throw new ScanInputError("No IaC document found. Choose Terraform, CloudFormation, Kubernetes, Pulumi, Docker Compose, a Dockerfile, a GitHub Actions workflow, a Helm template, an Ansible playbook, Bicep, or an ARM template.");
     if (!resources.length)
         warnings.push("No resources found in the submitted document.");
     if (/(?:!(?:Ref|Sub|GetAtt|If)\b|"(?:Ref|Fn::\w+)"\s*:|\$\{)/.test(content))
@@ -452,6 +531,88 @@ function runPipesToShell(text) {
         /\b(?:curl|wget)\b/i.test(text) &&
         /\|\s*(?:sudo\s+)?(?:\S*\/)?(?:ba)?sh\b/i.test(text));
 }
+function copySources(text) {
+    if (!/^(?:COPY|ADD)\b/i.test(text))
+        return undefined;
+    const rest = text.replace(/^(?:COPY|ADD)\b/i, "").trim();
+    if (rest.startsWith("[")) {
+        try {
+            const parsed = JSON.parse(rest);
+            if (!Array.isArray(parsed) || parsed.length < 2)
+                return [];
+            return parsed.slice(0, -1).map((item) => String(item));
+        }
+        catch {
+            return [];
+        }
+    }
+    const tokens = [];
+    for (const match of rest.matchAll(/"([^"]*)"|'([^']*)'|(\S+)/g)) {
+        const token = match[1] ?? match[2] ?? match[3];
+        if (token.startsWith("--"))
+            continue;
+        tokens.push(token);
+    }
+    if (tokens.length < 2)
+        return [];
+    return tokens.slice(0, -1);
+}
+function sourceIsSecret(source) {
+    const path = source.replace(/\\/g, "/").replace(/\/+$/, "");
+    const base = path.split("/").filter(Boolean).at(-1) ?? path;
+    if (base === ".env" || base === "id_rsa" || base === "id_ed25519")
+        return true;
+    if (base.endsWith(".pem"))
+        return true;
+    return base === "credentials";
+}
+function secretVariableName(name) {
+    const normalized = name.replace(/-/g, "_");
+    return (/(?:^|_)(?:password|passwd|secret|token)$/i.test(normalized) ||
+        /(?:^|_)(?:api_?key|auth_token|access_key|private_key)$/i.test(normalized));
+}
+function isShellReference(value) {
+    return (/^\$[A-Za-z_][A-Za-z0-9_]*$/.test(value) ||
+        /^\$\{[A-Za-z_][A-Za-z0-9_]*\}$/.test(value));
+}
+function parseImageAssignments(kind, rest) {
+    const trimmed = rest.trim();
+    if (!trimmed)
+        return [];
+    if (kind === "ARG" && /^[A-Za-z_][A-Za-z0-9_]*$/.test(trimmed))
+        return [{ name: trimmed, value: "" }];
+    if (!trimmed.includes("=")) {
+        const spaced = trimmed.match(/^([A-Za-z_][A-Za-z0-9_]*)\s+([\s\S]*)$/);
+        if (!spaced)
+            return [];
+        return [{ name: spaced[1], value: unquoteAssignment(spaced[2].trim()) }];
+    }
+    const pairs = [];
+    const pattern = /([A-Za-z_][A-Za-z0-9_]*)=(?:"([^"]*)"|'([^']*)'|([^\s]*))/g;
+    for (const match of trimmed.matchAll(pattern)) {
+        pairs.push({
+            name: match[1],
+            value: match[2] ?? match[3] ?? match[4] ?? "",
+        });
+    }
+    return pairs;
+}
+function unquoteAssignment(value) {
+    if ((value.startsWith('"') && value.endsWith('"') && value.length >= 2) ||
+        (value.startsWith("'") && value.endsWith("'") && value.length >= 2))
+        return value.slice(1, -1);
+    return value;
+}
+function workflowEnvIsLiteral(value) {
+    const trimmed = value.trim();
+    if (!trimmed)
+        return false;
+    if (/^\$\{\{\s*secrets\.[^}]+\}\}$/i.test(trimmed))
+        return false;
+    if (/^\$\{\{\s*github\.token\s*\}\}$/i.test(trimmed))
+        return false;
+    return true;
+}
 function lineLocation(line, path) {
     return { line, column: 1, path };
 }
@@ -500,6 +661,33 @@ function parseDockerfile(content) {
             locate: () => lineLocation(instruction.line, "run"),
         });
     });
+    instructions.forEach((instruction, index) => {
+        const sources = copySources(instruction.text);
+        if (!sources)
+            return;
+        resources.push({
+            id: `dockerfile.copy.${index + 1}`,
+            type: "dockerfile:copy",
+            value: { secret: sources.some(sourceIsSecret) },
+            locate: () => lineLocation(instruction.line, "copy"),
+        });
+    });
+    instructions.forEach((instruction, index) => {
+        const header = instruction.text.match(/^(ENV|ARG)\b\s*([\s\S]*)$/i);
+        if (!header)
+            return;
+        const kind = header[1].toUpperCase() === "ARG" ? "ARG" : "ENV";
+        const assignments = parseImageAssignments(kind, header[2] ?? "");
+        const literal = assignments.some((item) => secretVariableName(item.name) &&
+            item.value.trim() !== "" &&
+            !isShellReference(item.value.trim()));
+        resources.push({
+            id: `dockerfile.env.${index + 1}`,
+            type: "dockerfile:env",
+            value: { literal },
+            locate: () => lineLocation(instruction.line, "env"),
+        });
+    });
     return {
         format: "dockerfile",
         resources,
@@ -526,6 +714,14 @@ function workflowChecksOutHead(jobs) {
     }
     return false;
 }
+function runPrintsSecret(script) {
+    const logical = script.replace(/\\\r?\n\s*/g, " ");
+    return logical.split(/\n/).some((line) => {
+        const code = line.replace(/(^|\s)#[^\n]*$/, "");
+        return (/\b(?:echo|printf|print)\b/i.test(code) &&
+            /\$\{\{\s*secrets\./.test(code));
+    });
+}
 function permissionsAreBroad(top, jobs, pullRequestTarget) {
     const values = [
         top,
@@ -594,7 +790,27 @@ function parseGithubWorkflow(content) {
             value: { broad },
             locate: () => position(root.permissions != null ? ["permissions"] : ["on"]),
         });
+        const addEnv = (envValue, path) => {
+            for (const [key, raw] of Object.entries(object(envValue))) {
+                if (typeof raw !== "string" && raw != null)
+                    continue;
+                if (!secretVariableName(key))
+                    continue;
+                const value = typeof raw === "string" ? raw : "";
+                resources.push({
+                    id: `env.${[...path, key].join(".")}`,
+                    type: "github:env",
+                    value: { literal: workflowEnvIsLiteral(value) },
+                    locate: () => position([...path, key]),
+                });
+            }
+        };
+        addEnv(root.env, ["env"]);
         for (const [jobName, job] of Object.entries(object(root.jobs))) {
+            addEnv(object(job).env, ["jobs", jobName, "env"]);
+            array(object(job).steps).forEach((step, index) => {
+                addEnv(object(step).env, ["jobs", jobName, "steps", index, "env"]);
+            });
             array(object(job).steps).forEach((step, index) => {
                 const uses = object(step).uses;
                 if (typeof uses !== "string")
@@ -609,6 +825,17 @@ function parseGithubWorkflow(content) {
                     locate: () => position(["jobs", jobName, "steps", index, "uses"]),
                 });
             });
+            array(object(job).steps).forEach((step, index) => {
+                const run = object(step).run;
+                if (typeof run !== "string")
+                    return;
+                resources.push({
+                    id: `jobs.${jobName}.steps.${index}.run`,
+                    type: "github:run",
+                    value: { printsSecret: runPrintsSecret(run) },
+                    locate: () => position(["jobs", jobName, "steps", index, "run"]),
+                });
+            });
         }
     }
     if (!found)
@@ -649,3 +876,197 @@ function pulumiResourceMap(root) {
 function escapeRegex(value) {
     return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
+function maskNonCode(content) {
+    const withoutBlockComments = content
+        .replace(/\{\{-?\s*\/\*[\s\S]*?\*\/\s*-?\}\}/g, (match) => match.replace(/[^\n]/g, " "))
+        .replace(/\{#[\s\S]*?#\}/g, (match) => match.replace(/[^\n]/g, " "));
+    return withoutBlockComments
+        .split("\n")
+        .map((line) => {
+        let out = "";
+        let templates = 0;
+        let quote;
+        for (let index = 0; index < line.length; index++) {
+            const char = line[index];
+            const next = line[index + 1];
+            if (quote) {
+                out += char;
+                if (char === quote && line[index - 1] !== "\\")
+                    quote = undefined;
+                continue;
+            }
+            if (templates === 0 && (char === '"' || char === "'")) {
+                quote = char;
+                out += char;
+                continue;
+            }
+            if (char === "{" && next === "{") {
+                templates += 1;
+                out += char;
+                continue;
+            }
+            if (char === "}" && next === "}" && templates > 0) {
+                templates -= 1;
+                out += char;
+                continue;
+            }
+            if (templates === 0 && char === "#") {
+                return out + " ".repeat(line.length - out.length);
+            }
+            out += char;
+        }
+        return out;
+    })
+        .join("\n");
+}
+function lineAt(content, index) {
+    return content.slice(0, index).split("\n").length;
+}
+function firstLiteral(content, pattern) {
+    const match = pattern.exec(content);
+    if (!match || match.index === undefined)
+        return { present: false, line: 1 };
+    return { present: true, line: lineAt(content, match.index) };
+}
+function literalResource(id, type, match, path) {
+    return {
+        id,
+        type,
+        value: { present: match.present },
+        locate: () => lineLocation(match.line, path),
+    };
+}
+const helmTemplateWarning = "Helm templates are not executed. Only literal text outside comments is checked.";
+const ansibleFactsWarning = "Ansible facts are not executed. Only literal text outside comments is checked.";
+function parseHelm(content) {
+    const visible = maskNonCode(content);
+    const privileged = firstLiteral(visible, /privileged\s*:\s*["']?true["']?\b/);
+    const hostNetwork = firstLiteral(visible, /hostNetwork\s*:\s*["']?true["']?\b/);
+    const latest = firstLiteral(visible, /:latest\b/);
+    const socket = firstLiteral(visible, /(?:hostPath|volumes?)\b[\s\S]{0,500}docker\.sock|docker\.sock[\s\S]{0,200}\b(?:hostPath|volumes?)\b/);
+    return {
+        format: "helm",
+        resources: [
+            literalResource("helm.privileged", "helm:privileged", privileged, "privileged"),
+            literalResource("helm.hostNetwork", "helm:hostNetwork", hostNetwork, "hostNetwork"),
+            literalResource("helm.image", "helm:image", latest, "image"),
+            literalResource("helm.socket", "helm:socket", socket, "volume"),
+        ],
+        warnings: [helmTemplateWarning],
+    };
+}
+function parseAnsible(content) {
+    const visible = maskNonCode(content);
+    const become = firstLiteral(visible, /(?:^|\n)\s*(?:-\s+)?become\s*:\s*["']?(?:true|yes)["']?(?=\s|$)/);
+    const cidr = firstLiteral(visible, /(?:cidr|source)\s*:\s*(?:\|\s*)?(?:\n\s*-\s*)?["']?0\.0\.0\.0\/0\b/);
+    return {
+        format: "ansible",
+        resources: [
+            literalResource("ansible.become", "ansible:become", become, "become"),
+            literalResource("ansible.cidr", "ansible:cidr", cidr, "cidr"),
+        ],
+        warnings: [ansibleFactsWarning],
+    };
+}
+function maskIaCComments(content) {
+    const withoutBlock = content.replace(/\/\*[\s\S]*?\*\//g, (match) => match.replace(/[^\n]/g, " "));
+    return withoutBlock
+        .split("\n")
+        .map((line) => {
+        let out = "";
+        let quote;
+        for (let index = 0; index < line.length; index++) {
+            const char = line[index];
+            const next = line[index + 1];
+            if (quote) {
+                out += char;
+                if (char === "\\" && quote === '"') {
+                    if (next)
+                        out += next;
+                    index += 1;
+                    continue;
+                }
+                if (char === quote)
+                    quote = undefined;
+                continue;
+            }
+            if (char === '"' || char === "'") {
+                quote = char;
+                out += char;
+                continue;
+            }
+            if ((char === "/" && next === "/") ||
+                char === "#") {
+                return out + " ".repeat(line.length - out.length);
+            }
+            out += char;
+        }
+        return out;
+    })
+        .join("\n");
+}
+function addressValueIsOpen(after) {
+    return /(?:^|[\s\[,])(?:"\*"|"0\.0\.0\.0\/0"|'\*'|'0\.0\.0\.0\/0'|\*|0\.0\.0\.0\/0)(?=$|[\s,\]}"'])/.test(after);
+}
+function nearestScopeIsEgress(content, index) {
+    const windowStart = Math.max(0, index - 800);
+    const windowEnd = Math.min(content.length, index + 400);
+    const slice = content.slice(windowStart, windowEnd);
+    const relative = index - windowStart;
+    let nearest;
+    for (const match of slice.matchAll(/\b(Inbound|Outbound|ingress|egress)\b/gi)) {
+        const at = match.index ?? 0;
+        const distance = Math.abs(at - relative);
+        const egress = /^(?:outbound|egress)$/i.test(match[1] ?? "");
+        if (!nearest || distance < nearest.distance)
+            nearest = { distance, egress };
+    }
+    return nearest?.egress ?? false;
+}
+function firstOpenAddress(content) {
+    const pattern = /(source|destination)AddressPrefix(es)?["']?\s*[:=]/gi;
+    for (const match of content.matchAll(pattern)) {
+        const kind = (match[1] ?? "").toLowerCase();
+        const index = match.index ?? 0;
+        const after = content.slice(index + match[0].length, index + match[0].length + 240);
+        if (!addressValueIsOpen(after))
+            continue;
+        if (kind === "destination" && nearestScopeIsEgress(content, index))
+            continue;
+        return { present: true, line: lineAt(content, index) };
+    }
+    return { present: false, line: 1 };
+}
+function enclosingAzureType(content, index) {
+    const before = content.slice(Math.max(0, index - 4000), index);
+    const declarations = [
+        ...before.matchAll(/resource\s+[A-Za-z_][\w]*\s+['"](Microsoft\.[^'"]+)['"]|(?:["']type["']|type)\s*:\s*["'](Microsoft\.[^"']+)["']/g),
+    ];
+    const last = declarations.at(-1);
+    return last?.[1] ?? last?.[2] ?? "";
+}
+function firstPublicNetwork(content) {
+    const pattern = /publicNetworkAccess["']?\s*[:=]\s*(["']?)(Enabled|true|Disabled|false)\1(?![\w.-])/gi;
+    for (const match of content.matchAll(pattern)) {
+        if (!/^(?:enabled|true)$/i.test(match[2] ?? ""))
+            continue;
+        const index = match.index ?? 0;
+        const type = enclosingAzureType(content, index);
+        if (!/(?:database|storage|server)/i.test(type))
+            continue;
+        return { present: true, line: lineAt(content, index) };
+    }
+    return { present: false, line: 1 };
+}
+const azureExpressionWarning = "Bicep modules and ARM expressions are not evaluated.";
+function parseAzure(content, format) {
+    const visible = maskIaCComments(content);
+    return {
+        format,
+        resources: [
+            literalResource("azure.exposure", "azure:exposure", firstOpenAddress(visible), "sourceAddressPrefix"),
+            literalResource("azure.publicNetwork", "azure:publicNetwork", firstPublicNetwork(visible), "publicNetworkAccess"),
+        ],
+        warnings: [azureExpressionWarning],
+    };
+}

package/dist/iac/rules.js

@@ -239,6 +239,90 @@ export const rules = {
         detail: "A uses value is pinned to @main or @master.",
         remediation: "Pin the action to a release tag or a full commit SHA.",
     },
+    DF004: {
+        category: "security",
+        severity: "high",
+        title: "Secret file copied into the image",
+        detail: "A COPY or ADD instruction uses a secret file as a source.",
+        remediation: "Keep secret files out of the image. Mount them at runtime from a secret store.",
+    },
+    GH004: {
+        category: "security",
+        severity: "high",
+        title: "Workflow prints a secret",
+        detail: "A run script echoes or prints a secrets expression.",
+        remediation: "Remove the printed secret from the script. Pass secrets through an environment variable that the step does not print.",
+    },
+    DF005: {
+        category: "security",
+        severity: "high",
+        title: "Secret assigned in an image variable",
+        detail: "A Dockerfile ENV or ARG assigns a non-empty literal to a secret-like name.",
+        remediation: "Pass the value at runtime or from a secret mount. Do not bake a literal secret into ENV or ARG.",
+    },
+    GH005: {
+        category: "security",
+        severity: "high",
+        title: "Secret assigned in workflow env",
+        detail: "A workflow env mapping assigns a non-empty literal to a secret-like name.",
+        remediation: "Reference secrets or github.token in the env value. Do not commit a literal secret.",
+    },
+    AZ001: {
+        category: "security",
+        severity: "high",
+        title: "Broad network exposure",
+        detail: "A source address prefix allows every address, or a destination prefix is open outside an egress scope.",
+        remediation: "Restrict source address prefixes to approved ranges. Keep open destination prefixes on egress rules only.",
+    },
+    AZ002: {
+        category: "security",
+        severity: "high",
+        title: "Database or storage allows public network access",
+        detail: "publicNetworkAccess is Enabled or true on a database, storage, or server resource.",
+        remediation: "Set publicNetworkAccess to Disabled and reach the resource through a private endpoint.",
+    },
+    HELM001: {
+        category: "security",
+        severity: "critical",
+        title: "Privileged container in a Helm template",
+        detail: "The template sets privileged to true.",
+        remediation: "Set privileged to false. Isolate workloads that genuinely require elevated privileges.",
+    },
+    HELM002: {
+        category: "security",
+        severity: "high",
+        title: "Host network in a Helm template",
+        detail: "The template sets hostNetwork to true.",
+        remediation: "Disable hostNetwork unless a reviewed node-level component requires it.",
+    },
+    HELM003: {
+        category: "reliability",
+        severity: "medium",
+        title: "Unpinned image in a Helm template",
+        detail: "An image tag uses latest.",
+        remediation: "Pin an immutable digest or a release tag.",
+    },
+    HELM004: {
+        category: "security",
+        severity: "high",
+        title: "Docker socket mounted in a Helm template",
+        detail: "A hostPath or volume contains docker.sock.",
+        remediation: "Remove the Docker socket mount. Use a scoped volume or a reviewed runtime API instead.",
+    },
+    ANS001: {
+        category: "security",
+        severity: "high",
+        title: "Ansible task runs as root",
+        detail: "A play or task sets become to true or yes.",
+        remediation: "Set become to false unless the task has a reviewed need to run as root.",
+    },
+    ANS002: {
+        category: "security",
+        severity: "high",
+        title: "Broad network exposure",
+        detail: "A cidr or source allows 0.0.0.0/0.",
+        remediation: "Restrict the cidr or source to approved addresses.",
+    },
 };
 export function resourceFindings(resources, format) {
     const findings = [];
@@ -262,6 +346,18 @@ export function resourceFindings(resources, format) {
             checkGithub(resource, check);
             continue;
         }
+        if (format === "helm") {
+            checkHelm(resource, check);
+            continue;
+        }
+        if (format === "ansible") {
+            checkAnsible(resource, check);
+            continue;
+        }
+        if (format === "bicep" || format === "arm") {
+            checkAzure(resource, check);
+            continue;
+        }
         walk(resource.value, (key, value, path, parent) => {
             if (typeof value !== "string")
                 return;
@@ -289,6 +385,10 @@ function checkDockerfile(resource, check) {
         check("DF002", resource.value.unpinned === true, ["image"]);
     else if (resource.type === "dockerfile:run")
         check("DF003", resource.value.piped === true, ["run"]);
+    else if (resource.type === "dockerfile:copy")
+        check("DF004", resource.value.secret === true, ["copy"]);
+    else if (resource.type === "dockerfile:env")
+        check("DF005", resource.value.literal === true, ["env"]);
 }
 function checkGithub(resource, check) {
     if (resource.type === "github:trigger")
@@ -298,6 +398,32 @@ function checkGithub(resource, check) {
         check("GH002", resource.value.broad === true, ["permissions"]);
     else if (resource.type === "github:action")
         check("GH003", resource.value.floating === true, ["uses"]);
+    else if (resource.type === "github:run")
+        check("GH004", resource.value.printsSecret === true, ["run"]);
+    else if (resource.type === "github:env")
+        check("GH005", resource.value.literal === true, ["env"]);
+}
+function checkHelm(resource, check) {
+    if (resource.type === "helm:privileged")
+        check("HELM001", resource.value.present === true, ["privileged"]);
+    else if (resource.type === "helm:hostNetwork")
+        check("HELM002", resource.value.present === true, ["hostNetwork"]);
+    else if (resource.type === "helm:image")
+        check("HELM003", resource.value.present === true, ["image"]);
+    else if (resource.type === "helm:socket")
+        check("HELM004", resource.value.present === true, ["volume"]);
+}
+function checkAnsible(resource, check) {
+    if (resource.type === "ansible:become")
+        check("ANS001", resource.value.present === true, ["become"]);
+    else if (resource.type === "ansible:cidr")
+        check("ANS002", resource.value.present === true, ["cidr"]);
+}
+function checkAzure(resource, check) {
+    if (resource.type === "azure:exposure")
+        check("AZ001", resource.value.present === true, ["sourceAddressPrefix"]);
+    else if (resource.type === "azure:publicNetwork")
+        check("AZ002", resource.value.present === true, ["publicNetworkAccess"]);
 }
 function walk(value, visit, path = []) {
     if (Array.isArray(value))

package/dist/server.js

@@ -75,12 +75,16 @@ export function createServer(remote = false) {
                 "compose",
                 "dockerfile",
                 "github",
+                "helm",
+                "ansible",
+                "bicep",
+                "arm",
                 "application",
                 "auto",
             ])
                 .optional()
                 .default("auto")
-                .describe("Content format: terraform, cloudformation, kubernetes, pulumi, compose, application, auto. Includes Dockerfile and GitHub Actions."),
+                .describe("Content format: terraform, cloudformation, kubernetes, pulumi, compose, dockerfile, github, helm, ansible, bicep, arm, application, auto."),
         },
     }, async ({ content, focus, format, minSeverity, maxFindings }) => {
         const botHints = fetchPublicBotHints();
@@ -128,7 +132,7 @@ export function createServer(remote = false) {
             description: (name === "scan_iac_stub"
                 ? "Compatibility alias for scan_iac; runs the full scanner. "
                 : "") +
-                "Parse Terraform HCL/JSON, CloudFormation YAML/JSON, Kubernetes manifests, Pulumi YAML, Pulumi programs, or Docker Compose. Includes Dockerfile and GitHub Actions. Check security, reliability and cost rules with resource locations and remediation. Pulumi programs are scanned as text.",
+                "Parse Terraform HCL/JSON, CloudFormation YAML/JSON, Kubernetes manifests, Pulumi YAML, Pulumi programs, or Docker Compose. Includes Dockerfile, GitHub Actions, Helm templates, Ansible playbooks, Bicep files, and ARM templates. Helm templates, Ansible facts, Bicep modules, and ARM expressions are not executed. Check security, reliability and cost rules with resource locations and remediation. Pulumi programs are scanned as text.",
             annotations: {
                 readOnlyHint: true,
                 destructiveHint: false,
@@ -136,7 +140,7 @@ export function createServer(remote = false) {
             },
             _meta: { securitySchemes: [{ type: "oauth2", scopes: ["mcp"] }] },
             inputSchema: {
-                content: contentSchema.describe("Terraform HCL/JSON, CloudFormation YAML/JSON, Kubernetes YAML/JSON, Pulumi YAML or program text, or Docker Compose. Includes Dockerfile and GitHub Actions."),
+                content: contentSchema.describe("Terraform HCL/JSON, CloudFormation YAML/JSON, Kubernetes YAML/JSON, Pulumi YAML or program text, or Docker Compose. Includes Dockerfile, GitHub Actions, Helm templates, Ansible playbooks, Bicep files, and ARM templates."),
                 format: z
                     .enum([
                     "terraform",
@@ -146,6 +150,10 @@ export function createServer(remote = false) {
                     "compose",
                     "dockerfile",
                     "github",
+                    "helm",
+                    "ansible",
+                    "bicep",
+                    "arm",
                     "auto",
                 ])
                     .default("auto"),

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const VERSION = "0.6.9";
+export declare const VERSION = "0.6.11";

package/dist/version.js

@@ -1 +1 @@
-export const VERSION = "0.6.9";
+export const VERSION = "0.6.11";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skaleagents/swarm",
-  "version": "0.6.9",
+  "version": "0.6.11",
   "private": false,
   "publishConfig": {
     "access": "public"