@stll/oxlint-config 0.12.1 → 0.12.2

package/dist/toolchain-guard.mjs

@@ -645,7 +645,7 @@ const generateCloudSetup = ({ policy, cloud, nodeVersion }) => {
 };
 //#endregion
 //#region src/toolchain-container-inputs.ts
-const record$6 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const record$7 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 /** Filename class recognized by Dependabot's Docker Compose fetcher. */
 const isComposeDefinitionPath = (file) => /^\.?(?:docker-)?compose(?:-[\w]+)?(?:\.[\w-]+)?\.ya?ml$/i.test(file.split("/").at(-1) ?? "");
 /** Candidate YAML files are classified by their document shape after reading. */
@@ -692,11 +692,11 @@ const kubernetesPodSpecPaths = {
 };
 /** Shared semantic image enumeration for runtime checks and update-root generation. */
 const containerDocumentImages = (document, file) => {
-	if (!record$6(document)) return void 0;
+	if (!record$7(document)) return void 0;
 	const services = document["services"];
-	if (isComposeDefinitionPath(file) && record$6(services)) {
+	if (isComposeDefinitionPath(file) && record$7(services)) {
 		const images = [];
-		for (const [name, service] of Object.entries(services)) if (record$6(service) && service["image"] !== void 0) images.push({
+		for (const [name, service] of Object.entries(services)) if (record$7(service) && service["image"] !== void 0) images.push({
 			image: service["image"],
 			path: [
 				"services",
@@ -717,7 +717,7 @@ const containerDocumentImages = (document, file) => {
 		visited.add(resource);
 		if (typeof resource["apiVersion"] !== "string" || typeof resource["kind"] !== "string") return;
 		if (resource["kind"] === "List" && Array.isArray(resource["items"])) {
-			for (const [index, item] of resource["items"].entries()) if (record$6(item)) walkResource(item, [
+			for (const [index, item] of resource["items"].entries()) if (record$7(item)) walkResource(item, [
 				...prefix,
 				"items",
 				index
@@ -727,8 +727,8 @@ const containerDocumentImages = (document, file) => {
 		const specPath = Object.entries(kubernetesPodSpecPaths).find(([kind]) => kind === resource["kind"])?.[1];
 		if (specPath === void 0) return;
 		let spec = resource;
-		for (const key of specPath) spec = record$6(spec) ? spec[key] : void 0;
-		if (!record$6(spec)) return;
+		for (const key of specPath) spec = record$7(spec) ? spec[key] : void 0;
+		if (!record$7(spec)) return;
 		for (const key of [
 			"containers",
 			"initContainers",
@@ -736,7 +736,7 @@ const containerDocumentImages = (document, file) => {
 		]) {
 			const containers = spec[key];
 			if (!Array.isArray(containers)) continue;
-			for (const [index, container] of containers.entries()) if (record$6(container) && container["image"] !== void 0) images.push({
+			for (const [index, container] of containers.entries()) if (record$7(container) && container["image"] !== void 0) images.push({
 				image: container["image"],
 				path: [
 					...prefix,
@@ -839,7 +839,7 @@ const workspaceContains = ({ directory, file, patterns, rootMembership }) => {
 //#endregion
 //#region src/toolchain-dependabot.ts
 const dependabotRules = ["dependabot-policy"];
-const record$5 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const record$6 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const strings = (value) => Array.isArray(value) && value.every((entry) => typeof entry === "string");
 const sameStrings = (value, expected) => {
 	if (!strings(value) || value.length !== expected.length) return false;
@@ -861,8 +861,8 @@ const workspaceTable = (parsed, ecosystem) => {
 		case "cargo": return parsed["workspace"];
 		case "uv": {
 			const tool = parsed["tool"];
-			const uv = record$5(tool) ? tool["uv"] : void 0;
-			return record$5(uv) ? uv["workspace"] : void 0;
+			const uv = record$6(tool) ? tool["uv"] : void 0;
+			return record$6(uv) ? uv["workspace"] : void 0;
 		}
 		default: throw new Error("unknown workspace ecosystem", { cause: ecosystem });
 	}
@@ -882,7 +882,7 @@ const workspaceRoots = (files, ecosystem) => {
 					const document = parseDocument(text);
 					if (document.errors.length > 0) throw new Error(`${workspaceFile}:1: invalid pnpm workspace YAML`);
 					const parsed = document.toJS({ maxAliasCount: 100 });
-					if (!record$5(parsed)) throw new Error(`${workspaceFile}:1: pnpm workspace must contain an object`);
+					if (!record$6(parsed)) throw new Error(`${workspaceFile}:1: pnpm workspace must contain an object`);
 					const patterns = parsed["packages"] ?? [];
 					if (!strings(patterns)) throw new Error(`${workspaceFile}:1: pnpm packages must be a string array`);
 					workspaces.set(directory, patterns.map((pattern) => pattern.startsWith("!") ? `!${path.posix.normalize(pattern.slice(1))}` : path.posix.normalize(pattern)));
@@ -894,13 +894,13 @@ const workspaceRoots = (files, ecosystem) => {
 		}
 		try {
 			const parsed = ecosystem === "npm" ? JSON.parse(files[file] ?? "") : parse(files[file] ?? "");
-			if (!record$5(parsed)) continue;
+			if (!record$6(parsed)) continue;
 			if (ecosystem === "npm" && typeof parsed["packageManager"] === "string" && parsed["packageManager"].startsWith("pnpm@")) continue;
 			const value = workspaceTable(parsed, ecosystem);
-			const patterns = record$5(value) ? value[ecosystem === "npm" ? "packages" : "members"] : value;
-			const members = ecosystem === "cargo" && record$5(value) && patterns === void 0 ? [] : patterns;
+			const patterns = record$6(value) ? value[ecosystem === "npm" ? "packages" : "members"] : value;
+			const members = ecosystem === "cargo" && record$6(value) && patterns === void 0 ? [] : patterns;
 			if (strings(members)) {
-				const excluded = ecosystem !== "npm" && record$5(value) && strings(value["exclude"]) ? value["exclude"].map((pattern) => `!${pattern}`) : [];
+				const excluded = ecosystem !== "npm" && record$6(value) && strings(value["exclude"]) ? value["exclude"].map((pattern) => `!${pattern}`) : [];
 				workspaces.set(path.posix.dirname(file), [...members, ...excluded]);
 			}
 		} catch {}
@@ -951,11 +951,11 @@ const workspaceRoots = (files, ecosystem) => {
 		for (const directory of memberDirectories) try {
 			const parsed = parse(files[path.posix.join(directory, "Cargo.toml")] ?? "");
 			const workspace = parse(files[path.posix.join(root, "Cargo.toml")] ?? "")["workspace"];
-			const inherited = record$5(workspace) ? workspace["dependencies"] : void 0;
+			const inherited = record$6(workspace) ? workspace["dependencies"] : void 0;
 			const dependencyOwners = [parsed];
 			const targets = parsed["target"];
-			if (record$5(targets)) {
-				for (const target of Object.values(targets)) if (record$5(target)) dependencyOwners.push(target);
+			if (record$6(targets)) {
+				for (const target of Object.values(targets)) if (record$6(target)) dependencyOwners.push(target);
 			}
 			for (const owner of dependencyOwners) for (const key of [
 				"dependencies",
@@ -963,12 +963,12 @@ const workspaceRoots = (files, ecosystem) => {
 				"build-dependencies"
 			]) {
 				const dependencies = owner[key];
-				if (!record$5(dependencies)) continue;
+				if (!record$6(dependencies)) continue;
 				for (const [name, dependency] of Object.entries(dependencies)) {
-					if (!record$5(dependency)) continue;
+					if (!record$6(dependency)) continue;
 					const isInherited = dependency["workspace"] === true;
-					const resolved = isInherited && record$5(inherited) ? inherited[name] : dependency;
-					if (!record$5(resolved) || typeof resolved["path"] !== "string") continue;
+					const resolved = isInherited && record$6(inherited) ? inherited[name] : dependency;
+					if (!record$6(resolved) || typeof resolved["path"] !== "string") continue;
 					if (path.posix.isAbsolute(resolved["path"]) || /\\|\$|^[A-Za-z]:/.test(resolved["path"])) continue;
 					const target = path.posix.normalize(path.posix.join(isInherited ? root : directory, resolved["path"]));
 					const relative = path.posix.relative(root, target);
@@ -996,7 +996,7 @@ const javascriptEcosystem = (directory, files) => {
 	if (files[path.posix.join(root, "bun.lock")] !== void 0) return "bun";
 	try {
 		const manifest = JSON.parse(files[path.posix.join(root, "package.json")] ?? "{}");
-		if (record$5(manifest) && typeof manifest["packageManager"] === "string" && manifest["packageManager"].startsWith("bun@")) return "bun";
+		if (record$6(manifest) && typeof manifest["packageManager"] === "string" && manifest["packageManager"].startsWith("bun@")) return "bun";
 	} catch {}
 	return "npm";
 };
@@ -1008,7 +1008,7 @@ const pythonEcosystem = (file, files) => {
 	const pyproject = files[path.posix.join(root, "pyproject.toml")];
 	if (pyproject !== void 0) try {
 		const tool = parse(pyproject)["tool"];
-		if (record$5(tool) && record$5(tool["uv"])) return "uv";
+		if (record$6(tool) && record$6(tool["uv"])) return "uv";
 	} catch {}
 	return "pip";
 };
@@ -1079,7 +1079,7 @@ const checkDependabot = ({ files, policy }) => {
 		add("cannot resolve Dependabot YAML aliases");
 		return diagnostics;
 	}
-	if (!record$5(parsed) || parsed["version"] !== 2 || !Array.isArray(parsed["updates"])) {
+	if (!record$6(parsed) || parsed["version"] !== 2 || !Array.isArray(parsed["updates"])) {
 		add("Dependabot must declare version: 2 and an updates array");
 		return diagnostics;
 	}
@@ -1092,7 +1092,7 @@ const checkDependabot = ({ files, policy }) => {
 		});
 		if (legacyDocument.errors.length === 0) legacy = legacyDocument.toJS({ maxAliasCount: 100 });
 	} catch {}
-	const legacyUpdates = record$5(legacy) && Array.isArray(legacy["updates"]) ? legacy["updates"] : [];
+	const legacyUpdates = record$6(legacy) && Array.isArray(legacy["updates"]) ? legacy["updates"] : [];
 	const rootClaims = /* @__PURE__ */ new Map();
 	const directoryClaims = /* @__PURE__ */ new Map();
 	for (const [index, update] of parsed["updates"].entries()) {
@@ -1106,7 +1106,7 @@ const checkDependabot = ({ files, policy }) => {
 			return offset === void 0 ? 1 : lineCounter.linePos(offset).line;
 		};
 		const report = (key, message) => add(message, lineOf(key));
-		if (!record$5(update) || typeof update["package-ecosystem"] !== "string") {
+		if (!record$6(update) || typeof update["package-ecosystem"] !== "string") {
 			report("package-ecosystem", "each Dependabot update must declare a package ecosystem");
 			continue;
 		}
@@ -1140,26 +1140,75 @@ const checkDependabot = ({ files, policy }) => {
 		covered.set(ecosystem, matches);
 		const schedule = update["schedule"];
 		const legacyUpdate = legacyUpdates.at(index);
-		const legacySchedule = record$5(legacyUpdate) ? legacyUpdate["schedule"] : void 0;
-		if (record$5(schedule) && schedule["time"] === policy.schedule.time && (!record$5(legacySchedule) || legacySchedule["time"] !== policy.schedule.time)) report("schedule", `${ecosystem}: quote schedule time to preserve its string value in YAML 1.1`);
-		if (!record$5(schedule) || Object.keys(schedule).length !== Object.keys(policy.schedule).length || Object.entries(policy.schedule).some(([key, value]) => schedule[key] !== value)) report("schedule", `${ecosystem}: schedule must match the shared policy`);
+		const legacySchedule = record$6(legacyUpdate) ? legacyUpdate["schedule"] : void 0;
+		if (record$6(schedule) && schedule["time"] === policy.schedule.time && (!record$6(legacySchedule) || legacySchedule["time"] !== policy.schedule.time)) report("schedule", `${ecosystem}: quote schedule time to preserve its string value in YAML 1.1`);
+		if (!record$6(schedule) || Object.keys(schedule).length !== Object.keys(policy.schedule).length || Object.entries(policy.schedule).some(([key, value]) => schedule[key] !== value)) report("schedule", `${ecosystem}: schedule must match the shared policy`);
 		const cooldown = update["cooldown"];
-		if (!record$5(cooldown) || Object.keys(cooldown).length !== 1 || cooldown["default-days"] !== policy.cooldown.defaultDays) report("cooldown", `${ecosystem}: cooldown must contain only default-days: ${policy.cooldown.defaultDays}`);
+		if (!record$6(cooldown) || Object.keys(cooldown).length !== 1 || cooldown["default-days"] !== policy.cooldown.defaultDays) report("cooldown", `${ecosystem}: cooldown must contain only default-days: ${policy.cooldown.defaultDays}`);
 		const groups = update["groups"];
-		if (!record$5(groups) || Object.keys(groups).length !== Object.keys(policy.groups).length || Object.entries(policy.groups).some(([name, expected]) => {
+		if (!record$6(groups) || Object.keys(groups).length !== Object.keys(policy.groups).length || Object.entries(policy.groups).some(([name, expected]) => {
 			const group = groups[name];
-			return !record$5(group) || Object.keys(group).length !== 2 || !sameStrings(group["patterns"], expected.patterns) || !sameStrings(group["update-types"], expected.updateTypes);
+			return !record$6(group) || Object.keys(group).length !== 2 || !sameStrings(group["patterns"], expected.patterns) || !sameStrings(group["update-types"], expected.updateTypes);
 		})) report("groups", `${ecosystem}: groups must match the shared policy`);
 		const ignored = ignoredFor(ecosystem, policy);
 		const ignore = update["ignore"];
 		if (ignore !== void 0 && (!Array.isArray(ignore) || ignore.length === 0)) report("ignore", `${ecosystem}: omit ignore or provide a nonempty array`);
-		if (Array.isArray(ignore) && ignore.some((entry) => !record$5(entry) || typeof entry["dependency-name"] !== "string" || !ignored.includes(entry["dependency-name"]))) report("ignore", `${ecosystem}: ignore only packages owned by the shared policy`);
-		for (const name of ignored) if (!Array.isArray(ignore) || !ignore.some((entry) => record$5(entry) && entry["dependency-name"] === name && Object.keys(entry).length === 1)) report("ignore", `${ecosystem}: ignore all updates for shared pin ${name}`);
+		if (Array.isArray(ignore) && ignore.some((entry) => !record$6(entry) || typeof entry["dependency-name"] !== "string" || !ignored.includes(entry["dependency-name"]))) report("ignore", `${ecosystem}: ignore only packages owned by the shared policy`);
+		for (const name of ignored) if (!Array.isArray(ignore) || !ignore.some((entry) => record$6(entry) && entry["dependency-name"] === name && Object.keys(entry).length === 1)) report("ignore", `${ecosystem}: ignore all updates for shared pin ${name}`);
 	}
 	for (const [ecosystem, directories] of roots) for (const directory of directories) if (!covered.get(ecosystem)?.has(directory)) add(`add a ${ecosystem} update entry covering ${directory}`);
 	return diagnostics;
 };
 //#endregion
+//#region src/toolchain-dynamic-selectors.ts
+const locatorValidators = {
+	image: /^(?:jobs\.[\w-]+\.(?:container|services\.[\w-]+)|services\.[\w.-]+\.image)$/,
+	"bun-source": /^(?:jobs\.[\w-]+|runs)\.steps\.[\w-]+$/
+};
+const knownKind = (value) => typeof value === "string" && Object.hasOwn(locatorValidators, value);
+const record$5 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+/** One reviewed declaration identifies one unresolved selector, never a rule. */
+const parseDynamicSelectors = (input) => {
+	if (input === void 0) return [];
+	if (!Array.isArray(input)) throw new Error("dynamicSelectors must be an array");
+	const result = [];
+	const keys = /* @__PURE__ */ new Set();
+	for (const entry of input) {
+		if (!record$5(entry) || Object.keys(entry).some((key) => ![
+			"path",
+			"kind",
+			"reason",
+			"at",
+			"line"
+		].includes(key)) || typeof entry["path"] !== "string" || entry["path"] === "" || /[\\:$*?]|[^\S ]/.test(entry["path"]) || entry["path"].split("/").some((part) => part === "" || part === "." || part === "..") || typeof entry["reason"] !== "string" || entry["reason"].trim() === "") throw new Error("each dynamic selector requires an exact repository path, known kind and nonempty reason");
+		const kind = entry["kind"];
+		if (!knownKind(kind)) throw new Error("unknown dynamic selector kind");
+		let selector;
+		if (Object.hasOwn(entry, "line") && !Object.hasOwn(entry, "at") && typeof entry["line"] === "number" && Number.isSafeInteger(entry["line"]) && entry["line"] > 0) selector = {
+			path: entry["path"],
+			kind,
+			reason: entry["reason"],
+			line: entry["line"]
+		};
+		else if (!Object.hasOwn(entry, "line") && typeof entry["at"] === "string" && locatorValidators[kind].test(entry["at"])) selector = {
+			path: entry["path"],
+			kind,
+			reason: entry["reason"],
+			at: entry["at"]
+		};
+		else throw new Error("dynamic selector requires one positive line or a kind-specific job/service/step ID locator");
+		const key = JSON.stringify([
+			selector.path,
+			selector.kind,
+			selector.at ?? selector.line
+		]);
+		if (keys.has(key)) throw new Error("dynamic selector locations must be unique");
+		keys.add(key);
+		result.push(selector);
+	}
+	return result;
+};
+//#endregion
 //#region src/toolchain-engine-floors.ts
 const record$4 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const repositoryPath = (value) => typeof value === "string" && value !== "" && !/^[A-Za-z]:/.test(value) && !/[\\\s]/.test(value) && !Array.from(value).some((character) => character.charCodeAt(0) < 32) && value.split("/").every((part) => part !== "" && part !== "." && part !== "..");
@@ -1971,7 +2020,7 @@ const pythonRequirementMatches = (requirement, version) => {
 	});
 };
 /** Check runtime declarations only in the files that declare or configure them. */
-const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, repository, onDelegated, engineFloors = [], onEngineFloor }) => {
+const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, repository, onDelegated, dynamicSelectors = [], onDynamicSelector, engineFloors = [], onEngineFloor }) => {
 	const diagnostics = [];
 	const name = path.posix.basename(file);
 	const lines = text.split(/\r?\n/);
@@ -1983,6 +2032,16 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 			message
 		});
 	};
+	let currentLocation;
+	const dynamic = (value) => typeof value === "string" && value.includes("$");
+	const authorizeDynamic = (kind, line, at = currentLocation) => {
+		const matches = dynamicSelectors.filter((entry) => entry.path === file && entry.kind === kind && (entry.at !== void 0 ? entry.at === at : entry.line === line));
+		if (matches.length !== 1) return false;
+		const entry = matches.at(0);
+		if (entry === void 0) return false;
+		onDynamicSelector?.(entry);
+		return true;
+	};
 	const lineOf = (key) => Math.max(1, lines.findIndex((line) => line.includes(key)) + 1);
 	const pin = ({ rule, value, expected, label, line = 1, selector }) => {
 		let matches = value === expected;
@@ -2184,12 +2243,13 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 			line: index + 1
 		});
 	});
-	const checkRuntimeImage = ({ image, line, label }) => {
+	const checkRuntimeImage = ({ image, line, label, at }) => {
 		const unknownRuntime = () => {
+			if (dynamic(image) && authorizeDynamic("image", line, at)) return;
 			add({
 				rule: "runtime-docker",
 				line,
-				message: `cannot determine ${label} runtime; use a static image or a reasoned runtime-docker opt-out`
+				message: `cannot determine ${label} runtime; use a static image or a scoped dynamicSelectors declaration`
 			});
 		};
 		if (typeof image !== "string") {
@@ -2418,6 +2478,7 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 					checkRuntimeImage({
 						image: entry.image,
 						line,
+						at: entry.path.join("."),
 						label: classified?.ecosystem === "docker-compose" ? "Compose image" : "Kubernetes image"
 					});
 				}
@@ -2452,8 +2513,22 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 	let checkoutBindings = [];
 	let checkoutDestinations = /* @__PURE__ */ new Map();
 	let unknownCheckoutDestination = false;
+	let unreviewableCheckoutSource = false;
 	const staticRepositoryPath = (value) => typeof value === "string" && value !== "" && !value.includes("${{") && !value.includes("\\") && !value.includes(":") && !path.posix.isAbsolute(value) && !value.split("/").includes("..");
 	const normalizeCheckoutPath = (prefix) => path.posix.normalize(prefix).replace(/\/$/, "") || ".";
+	const checkoutProvidersFor = (selector) => {
+		if (selector === void 0) return checkoutBindings;
+		let deepest;
+		for (const entry of checkoutBindings) {
+			if (entry.path !== "." && selector !== entry.path && !selector.startsWith(`${entry.path}/`)) continue;
+			if (deepest === void 0 || entry.path !== "." && (deepest.path === "." || entry.path.length > deepest.path.length)) deepest = entry;
+		}
+		return checkoutBindings.filter((entry) => entry.path === deepest?.path);
+	};
+	const hasAmbiguousCheckoutWriters = (selector, providers) => {
+		if (providers.length > 0) return providers.some((entry) => (checkoutDestinations.get(entry.path) ?? 0) > 1);
+		return [...checkoutDestinations].some(([prefix, count]) => count > 1 && (selector === void 0 || prefix === "." || selector === prefix || selector.startsWith(`${prefix}/`)));
+	};
 	const checkReference = ({ value, tool, line }) => {
 		const allowed = {
 			node: [".node-version", ".nvmrc"],
@@ -2462,8 +2537,28 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 		}[tool];
 		const rule = tool === "bun" ? "bun-pins" : "runtime-workflow";
 		const selector = staticRepositoryPath(value) ? path.posix.normalize(value) : void 0;
-		const binding = selector === void 0 ? void 0 : checkoutBindings.findLast((entry) => entry.path === "." || selector === entry.path || selector.startsWith(`${entry.path}/`));
+		const providers = checkoutProvidersFor(selector);
+		const binding = selector === void 0 ? void 0 : providers.at(-1);
+		const dynamicSource = providers.some((entry) => entry.dynamicSource);
+		const sparseFailure = providers.find((entry) => {
+			if (entry.sparse.mode === "invalid") return true;
+			if (entry.sparse.mode !== "files" && entry.sparse.mode !== "mixed") return false;
+			if (selector === void 0) return true;
+			const selectedFile = entry.path === "." ? selector : path.posix.relative(entry.path, selector);
+			return !entry.sparse.paths.has(selectedFile);
+		});
+		if (sparseFailure !== void 0) {
+			let missingFile = "the selected version file";
+			if (selector !== void 0) missingFile = sparseFailure.path === "." ? selector : path.posix.relative(sparseFailure.path, selector);
+			add({
+				rule,
+				line,
+				message: `checkout sparse-checkout must explicitly list ${missingFile} without invalid literal patterns`
+			});
+			return;
+		}
 		if (selector === void 0) {
+			if (tool === "bun" && dynamic(value) && !unreviewableCheckoutSource && authorizeDynamic("bun-source", line)) return;
 			add({
 				rule,
 				line,
@@ -2471,7 +2566,8 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 			});
 			return;
 		}
-		if (unknownCheckoutDestination || [...checkoutDestinations].some(([prefix, count]) => count > 1 && (prefix === "." || selector === prefix || selector.startsWith(`${prefix}/`)))) {
+		if (unknownCheckoutDestination || hasAmbiguousCheckoutWriters(selector, providers)) {
+			if (tool === "bun" && dynamicSource && !unreviewableCheckoutSource && authorizeDynamic("bun-source", line)) return;
 			add({
 				rule,
 				line,
@@ -2480,6 +2576,7 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 			return;
 		}
 		if (binding?.source === "untrusted") {
+			if (tool === "bun" && dynamicSource && !unreviewableCheckoutSource && authorizeDynamic("bun-source", line)) return;
 			add({
 				rule,
 				line: binding.line,
@@ -2496,13 +2593,15 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 			});
 			return;
 		}
-		if (binding !== void 0 && (binding.sparse.mode === "invalid" || binding.sparse.mode === "files" && !binding.sparse.paths.has(target))) {
-			add({
-				rule,
-				line,
-				message: `checkout sparse-checkout must explicitly list ${target} without dynamic, glob, or negation patterns`
-			});
-			return;
+		if (binding !== void 0 && (binding.sparse.mode === "dynamic" || binding.sparse.mode === "mixed")) {
+			if (tool !== "bun" || unreviewableCheckoutSource || !authorizeDynamic("bun-source", line)) {
+				add({
+					rule,
+					line,
+					message: `checkout sparse-checkout must explicitly list ${target} without dynamic, glob, or negation patterns`
+				});
+				return;
+			}
 		}
 		if (binding?.source === "delegated") {
 			onDelegated?.({
@@ -2624,10 +2723,10 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 		return inputs;
 	};
 	const getInput = (node, key) => inputsOf(node).get(key.toUpperCase());
-	const dynamicRefBody = (value) => {
-		if (typeof value !== "string" || !value.startsWith("${{")) return void 0;
+	const expressionAt = (value, start) => {
+		if (!value.startsWith("${{", start)) return void 0;
 		let quote;
-		for (let index = 3; index < value.length; index++) {
+		for (let index = start + 3; index < value.length; index++) {
 			const character = value.at(index);
 			if (quote !== void 0) {
 				if (character === quote) if (quote === "'" && value.at(index + 1) === "'") index++;
@@ -2637,9 +2736,33 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 			}
 			if (character === "'" || character === "\"") quote = character;
 			else if (value.startsWith("${{", index)) return void 0;
-			else if (character === "}" && value.at(index + 1) === "}") return index === value.length - 2 ? value.slice(3, index).trim() : void 0;
+			else if (character === "}" && value.at(index + 1) === "}") return {
+				body: value.slice(start + 3, index).trim(),
+				end: index + 2
+			};
 		}
 	};
+	const dynamicRefBody = (value) => {
+		if (typeof value !== "string") return void 0;
+		const expression = expressionAt(value, 0);
+		return expression?.end === value.length ? expression.body : void 0;
+	};
+	const sparseEntryIsValid = (entry) => {
+		let literalPath = "";
+		let position = 0;
+		while (position < entry.length) {
+			const start = entry.indexOf("${{", position);
+			const literal = entry.slice(position, start < 0 ? entry.length : start);
+			if (/[!$*?[\]\\:]/.test(literal) || literal.split("/").includes("..")) return false;
+			literalPath += literal;
+			if (start < 0) break;
+			const expression = expressionAt(entry, start);
+			if (expression === void 0 || expression.body === "") return false;
+			literalPath += "expression";
+			position = expression.end;
+		}
+		return staticRepositoryPath(literalPath);
+	};
 	const checkoutPrefixOf = (node) => {
 		const destination = getInput(node, "path");
 		if (destination === void 0) return ".";
@@ -2652,11 +2775,19 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 		const value = getInput(node, "sparse-checkout");
 		const cone = getInput(node, "sparse-checkout-cone-mode");
 		if (!isScalar(value) || typeof value.value !== "string" || cone !== void 0 && (!isScalar(cone) || cone.value !== true && cone.value !== false && cone.value !== "true" && cone.value !== "false")) return { mode: "invalid" };
-		const paths = value.value.split(/\r?\n/).map((entry) => entry.trim()).filter((entry) => entry !== "");
-		if (paths.length === 0 || paths.some((entry) => !staticRepositoryPath(entry) || entry.startsWith("!") || /[*?[\]]/.test(entry))) return { mode: "invalid" };
+		const paths = value.value.split(/\r?\n/).map((entry) => entry.trim().replace(/^\//, "")).filter((entry) => entry !== "");
+		if (paths.length === 0 || paths.some((entry) => !sparseEntryIsValid(entry))) return { mode: "invalid" };
+		const literalPaths = new Set(paths.filter((entry) => !dynamic(entry)));
+		if (paths.some(dynamic)) {
+			if (literalPaths.size === 0) return { mode: "dynamic" };
+			return {
+				mode: "mixed",
+				paths: literalPaths
+			};
+		}
 		return {
 			mode: "files",
-			paths: new Set(paths)
+			paths: literalPaths
 		};
 	};
 	let currentEngineFloor;
@@ -2686,8 +2817,9 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 		}
 		if (value.startsWith("./")) {
 			const selector = staticRepositoryPath(value) ? path.posix.normalize(value) : void 0;
-			const binding = selector === void 0 ? void 0 : checkoutBindings.findLast((entry) => entry.path === "." || selector === entry.path || selector.startsWith(`${entry.path}/`));
-			if (selector === void 0 || unknownCheckoutDestination || binding !== void 0 && binding.source !== "tracked" || [...checkoutDestinations].some(([prefix, count]) => count > 1 && (prefix === "." || selector === prefix || selector.startsWith(`${prefix}/`)))) add({
+			const providers = checkoutProvidersFor(selector);
+			const binding = selector === void 0 ? void 0 : providers.at(-1);
+			if (selector === void 0 || unknownCheckoutDestination || binding !== void 0 && binding.source !== "tracked" || hasAmbiguousCheckoutWriters(selector, providers)) add({
 				rule: "action-pins",
 				line,
 				message: "local actions require an unambiguous checkout of the current source snapshot"
@@ -2743,24 +2875,55 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 			const checkoutRepository = getInput(node, "repository");
 			const checkoutRef = getInput(node, "ref");
 			const prefix = checkoutPrefixOf(node);
+			const clean = getInput(node, "clean");
+			const cleanIsResolved = clean === void 0 || isScalar(clean) && !dynamic(clean.value);
 			let repo;
 			if (checkoutRepository !== void 0) repo = isScalar(checkoutRepository) ? checkoutRepository.value : null;
 			const self = repo === void 0 || repo === "${{ github.repository }}" || typeof repo === "string" && repository !== void 0 && repo.toLowerCase() === repository.toLowerCase();
 			const workflowSource = repo === "${{ job.workflow_repository }}" && isScalar(checkoutRef) && checkoutRef.value === "${{ job.workflow_sha }}";
-			const currentSource = self && checkoutRef === void 0;
-			const refValue = isScalar(checkoutRef) ? checkoutRef.value : void 0;
+			const triggers = getNode(document.contents, "on");
+			const callerContext = (() => {
+				if (isMap(triggers)) return [...keysOf(triggers)];
+				if (isSeq(triggers)) return triggers.items.map((event) => isScalar(event) ? event.value : void 0);
+				if (isScalar(triggers)) return [triggers.value];
+				return [];
+			})().includes("workflow_call");
+			let refValue = isScalar(checkoutRef) ? checkoutRef.value : void 0;
+			if (callerContext && (repo === void 0 || repo === "${{ github.repository }}") && checkoutRef === void 0) refValue = "${{ github.sha }}";
+			const currentRef = dynamicRefBody(refValue);
+			const currentSource = self && !callerContext && (checkoutRef === void 0 || currentRef === "github.sha");
 			const dynamicRef = dynamicRefBody(refValue);
-			const delegatedSource = (self || repo === "${{ job.workflow_repository }}") && dynamicRef !== void 0 && dynamicRef !== "" && !/^(?:'(?:[^']|'')*'|"(?:[^"\\]|\\.)*"|(?:true|false|null)|-?(?:0x[\da-f]+|(?:\d+(?:\.\d*)?|\.\d+)(?:e[+-]?\d+)?))$/i.test(dynamicRef) && !/^(?:github\s*(?:\.\s*sha|\[\s*['"]sha['"]\s*\])|job\s*(?:\.\s*workflow_sha|\[\s*['"]workflow_sha['"]\s*\]))$/i.test(dynamicRef);
+			const delegatedSource = !currentSource && (self || repo === "${{ job.workflow_repository }}") && dynamicRef !== void 0 && dynamicRef !== "" && !/^(?:'(?:[^']|'')*'|"(?:[^"\\]|\\.)*"|(?:true|false|null)|-?(?:0x[\da-f]+|(?:\d+(?:\.\d*)?|\.\d+)(?:e[+-]?\d+)?))$/i.test(dynamicRef) && (!/^(?:github\s*(?:\.\s*sha|\[\s*['"]sha['"]\s*\])|job\s*(?:\.\s*workflow_sha|\[\s*['"]workflow_sha['"]\s*\]))$/i.test(dynamicRef) || callerContext && currentRef === "github.sha");
+			const validSource = cleanIsResolved && ref === approved?.sha && sourceMap({
+				node,
+				key: "if"
+			}) === void 0 && sourceMap({
+				node,
+				key: "continue-on-error"
+			}) === void 0 && (currentSource || workflowSource || delegatedSource);
+			if (!validSource) unreviewableCheckoutSource = true;
 			if (!staticRepositoryPath(prefix)) checkoutBindings.push({
 				path: ".",
+				dynamicSource: validSource && dynamic(prefix),
 				source: "untrusted",
 				reason: "checkout destination must be a static repository path",
 				line,
-				sparse: { mode: "invalid" }
+				sparse: sparseCheckoutOf(node)
 			});
 			else {
 				const destination = normalizeCheckoutPath(prefix);
-				const trustedWriter = ref === approved?.sha && sourceMap({
+				checkoutBindings = checkoutBindings.map((entry) => {
+					if (entry.path === destination || destination !== "." && !entry.path.startsWith(`${destination}/`)) return entry;
+					return {
+						path: entry.path,
+						sparse: { mode: "all" },
+						dynamicSource: false,
+						source: "untrusted",
+						reason: "a later ancestor checkout invalidates this descendant destination",
+						line
+					};
+				});
+				const trustedWriter = cleanIsResolved && ref === approved?.sha && sourceMap({
 					node,
 					key: "if"
 				}) === void 0 && sourceMap({
@@ -2769,18 +2932,21 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 				}) === void 0 && checkoutDestinations.get(destination) === 1 && !unknownCheckoutDestination;
 				if (trustedWriter && delegatedSource && typeof refValue === "string") checkoutBindings.push({
 					path: destination,
+					dynamicSource: validSource && delegatedSource,
 					sparse: sparseCheckoutOf(node),
 					source: "delegated",
 					ref: refValue
 				});
 				else if (trustedWriter && (workflowSource || currentSource)) checkoutBindings.push({
 					path: destination,
+					dynamicSource: validSource && delegatedSource,
 					sparse: sparseCheckoutOf(node),
 					source: "tracked"
 				});
 				else {
 					let reason = "checkout does not select a trusted repository source snapshot";
-					if (ref !== approved?.sha) reason = "actions/checkout must use the approved action SHA";
+					if (!cleanIsResolved) reason = "checkout clean must be statically resolved";
+					else if (ref !== approved?.sha) reason = "actions/checkout must use the approved action SHA";
 					else if (sourceMap({
 						node,
 						key: "if"
@@ -2791,6 +2957,7 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 					else if (checkoutDestinations.get(destination) !== 1 || unknownCheckoutDestination) reason = "checkout destination must have exactly one static writer";
 					checkoutBindings.push({
 						path: destination,
+						dynamicSource: validSource && delegatedSource,
 						sparse: sparseCheckoutOf(node),
 						source: "untrusted",
 						reason,
@@ -2839,21 +3006,23 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 			line: reference === void 0 ? line : nodeLine(reference)
 		});
 	};
-	const checkContainer = (node) => {
+	const checkContainer = (node, at) => {
 		node = resolveNode(node);
 		if (node === void 0) return;
 		const image = isMap(node) ? getNode(node, "image") : node;
 		checkRuntimeImage({
 			image: isScalar(image) ? image.value : void 0,
 			line: nodeLine(image ?? node),
-			label: "container image"
+			label: "container image",
+			at
 		});
 	};
-	const checkSteps = (node, floor) => {
+	const checkSteps = (node, locationPrefix, floor) => {
 		currentEngineFloor = void 0;
 		checkoutBindings = [];
 		checkoutDestinations = /* @__PURE__ */ new Map();
 		unknownCheckoutDestination = false;
+		unreviewableCheckoutSource = false;
 		node = resolveNode(node);
 		if (!isSeq(node)) return;
 		for (const step of node.items) {
@@ -2869,9 +3038,14 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 		}
 		currentEngineFloor = floor;
 		try {
-			for (const step of node.items) checkAction(step);
+			for (const step of node.items) {
+				const id = getNode(step, "id");
+				currentLocation = isScalar(id) && typeof id.value === "string" ? `${locationPrefix}.steps.${id.value}` : void 0;
+				checkAction(step);
+			}
 		} finally {
 			currentEngineFloor = void 0;
+			currentLocation = void 0;
 		}
 	};
 	try {
@@ -2885,15 +3059,15 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 				currentEngineFloor = void 0;
 				const job = getNode(jobs, key);
 				checkAction(job);
-				checkContainer(getNode(job, "container"));
+				checkContainer(getNode(job, "container"), `jobs.${key}.container`);
 				const services = getNode(job, "services");
-				if (isMap(services)) for (const service of keysOf(services)) checkContainer(getNode(services, service));
-				checkSteps(getNode(job, "steps"), engineFloors.find((entry) => entry.job === key));
+				if (isMap(services)) for (const service of keysOf(services)) checkContainer(getNode(services, service), `jobs.${key}.services.${service}`);
+				checkSteps(getNode(job, "steps"), `jobs.${key}`, engineFloors.find((entry) => entry.job === key));
 			}
 		} else {
 			const runs = getNode(document.contents, "runs");
 			const using = getNode(runs, "using");
-			if (isScalar(using) && using.value === "composite") checkSteps(getNode(runs, "steps"));
+			if (isScalar(using) && using.value === "composite") checkSteps(getNode(runs, "steps"), "runs");
 			if (isScalar(using) && using.value === "docker") {
 				const image = getNode(runs, "image");
 				const value = isScalar(image) ? image.value : void 0;
@@ -3122,7 +3296,7 @@ const record = (value) => typeof value === "object" && value !== null && !Array.
 const array = (value) => Array.isArray(value);
 /** Repository-owned declarations are explicit; malformed decisions fail closed. */
 const parseToolchainConfiguration = (input) => {
-	if (!record(input) || Object.keys(input).some((key) => key !== "optOuts" && key !== "cloud" && key !== "engineFloors") || input["optOuts"] !== void 0 && !array(input["optOuts"])) throw new Error("stll-toolchain.json accepts only optOuts, cloud and engineFloors declarations");
+	if (!record(input) || Object.keys(input).some((key) => key !== "optOuts" && key !== "cloud" && key !== "engineFloors" && key !== "dynamicSelectors") || input["optOuts"] !== void 0 && !array(input["optOuts"])) throw new Error("stll-toolchain.json accepts only optOuts, cloud, engineFloors and dynamicSelectors declarations");
 	const disabled = /* @__PURE__ */ new Set();
 	const optOuts = input["optOuts"] ?? [];
 	if (!array(optOuts)) throw new Error("optOuts must be an array");
@@ -3135,7 +3309,8 @@ const parseToolchainConfiguration = (input) => {
 	return {
 		disabled,
 		cloud: parseCloudSetup(input["cloud"]),
-		engineFloors: parseEngineFloors(input["engineFloors"])
+		engineFloors: parseEngineFloors(input["engineFloors"]),
+		dynamicSelectors: parseDynamicSelectors(input["dynamicSelectors"])
 	};
 };
 /** Read one tracked configuration snapshot for guards and policy generation. */
@@ -3201,10 +3376,12 @@ const checkToolchain = ({ root, policy, onDelegated }) => {
 	let disabled = /* @__PURE__ */ new Set();
 	let cloud;
 	const engineFloors = [];
+	let dynamicSelectors = [];
 	if (files["stll-toolchain.json"] !== void 0) try {
 		const configuration = parseToolchainConfiguration(JSON.parse(files["stll-toolchain.json"]));
 		disabled = configuration.disabled;
 		cloud = configuration.cloud;
+		dynamicSelectors = configuration.dynamicSelectors;
 		for (const entry of configuration.engineFloors) engineFloors.push(resolveEngineFloor(entry, files));
 	} catch (error) {
 		diagnostics.push({
@@ -3244,6 +3421,7 @@ const checkToolchain = ({ root, policy, onDelegated }) => {
 	}
 	const exercisedFloors = /* @__PURE__ */ new Set();
 	const mismatchedFloors = /* @__PURE__ */ new Set();
+	const selectorMatches = /* @__PURE__ */ new Map();
 	diagnostics.push(...checkPackageFiles({
 		files,
 		policy
@@ -3259,6 +3437,8 @@ const checkToolchain = ({ root, policy, onDelegated }) => {
 			}
 		},
 		trackedFiles,
+		dynamicSelectors: dynamicSelectors.filter((entry) => entry.path === file),
+		onDynamicSelector: (entry) => selectorMatches.set(entry, (selectorMatches.get(entry) ?? 0) + 1),
 		repository,
 		onDelegated,
 		engineFloors: engineFloors.filter((entry) => entry.workflow === file),
@@ -3274,6 +3454,12 @@ const checkToolchain = ({ root, policy, onDelegated }) => {
 		line: 1,
 		message: `engine floor ${entry.workflow}:${entry.job} requires a setup-node exact patch satisfying ${entry.package} engines.node minimum major ${entry.major}`
 	});
+	for (const entry of dynamicSelectors) if (selectorMatches.get(entry) !== 1) diagnostics.push({
+		rule: "configuration",
+		path: "stll-toolchain.json",
+		line: 1,
+		message: `dynamic selector ${entry.path}:${entry.at ?? entry.line} must match exactly one unresolved ${entry.kind} selector`
+	});
 	diagnostics.push(...checkDependabot({
 		files,
 		policy: policy.dependabot