@svp-labs/talos 0.0.0 → 0.1.0

package/dist/checks/docs/spelling.js

@@ -0,0 +1,83 @@
+import { access, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { lint } from 'cspell';
+import { CSPELL_CONFIG, gateSettings, renderCspellBase, spellingFiles, spellingFinding, WORDS_FILE, } from './cspell.js';
+import { readOwnTexts, readText } from './files.js';
+import { APPLIES, EngineError, skip } from '../../core/check.js';
+import { glossaryWords, parseGlossary } from '../../docs/glossary.js';
+async function exists(path) {
+    try {
+        await access(path);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** The project's files minus the configs Talos rendered, whose words are Talos's. */
+async function ownFiles(ctx) {
+    return (await readOwnTexts(ctx, spellingFiles(ctx.facts))).map((doc) => doc.file);
+}
+/** Writes the run's settings into the scratch directory: the glossary's terms are a dictionary. */
+async function writeSettings(ctx) {
+    const glossaryText = await readText(ctx, ctx.config.docs.glossary);
+    const glossary = join(ctx.scratch, 'glossary.txt');
+    const terms = glossaryText === undefined ? [] : glossaryWords(parseGlossary(glossaryText));
+    await writeFile(glossary, `${terms.join('\n')}\n`);
+    const words = join(ctx.root, WORDS_FILE);
+    const settings = gateSettings({ glossary, ...((await exists(words)) ? { words } : {}) });
+    const path = join(ctx.scratch, 'cspell.json');
+    await writeFile(path, JSON.stringify(settings, null, 2));
+    return path;
+}
+async function spell(ctx) {
+    const files = await ownFiles(ctx);
+    if (files.length === 0)
+        return [];
+    const config = await writeSettings(ctx);
+    const list = join(ctx.scratch, 'files.txt');
+    // cspell reads a file list's entries relative to the list itself, so they are absolute.
+    await writeFile(list, `${files.map((file) => join(ctx.root, file)).join('\n')}\n`);
+    const issues = [];
+    const errors = [];
+    await lint([], {
+        config,
+        root: ctx.root,
+        fileList: [list],
+        progress: false,
+        summary: false,
+        mustFindFiles: false,
+        gitignore: false,
+        dot: true,
+    }, {
+        issue: (issue) => issues.push(issue),
+        error: (message) => errors.push(message),
+        info: () => undefined,
+        debug: () => undefined,
+        progress: () => undefined,
+        result: () => undefined,
+    });
+    if (errors.length > 0)
+        throw new EngineError(`cspell failed: ${errors[0] ?? ''}`);
+    return issues.map((issue) => spellingFinding(ctx.root, issue));
+}
+/** cspell over docs, code, scripts and CI: one finding per unknown word where it occurs. */
+export const spellingCheck = {
+    id: 'docs/spelling',
+    tier: 'head',
+    scope: 'repo',
+    title: 'cspell',
+    applies: (ctx) => spellingFiles(ctx.facts).length > 0 ? APPLIES : skip('the repository has nothing to spell'),
+    run: spell,
+};
+export const cspellBase = {
+    path: CSPELL_CONFIG,
+    scope: 'repo',
+    applies: (ctx) => spellingFiles(ctx.facts).length > 0,
+    render: (ctx) => renderCspellBase(ctx.version, ctx.config.exclude, ctx.config.components.map((component) => component.lang)),
+    extension: {
+        path: WORDS_FILE,
+        initial: () => "# Words the dictionaries don't know, one per line, grouped and sorted.\n",
+    },
+};
+//# sourceMappingURL=spelling.js.map

package/dist/checks/docs/spelling.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spelling.js","sourceRoot":"","sources":["../../../src/checks/docs/spelling.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAC9B,OAAO,EACL,aAAa,EACb,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,eAAe,EACf,UAAU,GACX,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,EAAE,OAAO,EAAiC,WAAW,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAGhG,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEtE,KAAK,UAAU,MAAM,CAAC,IAAY;IAChC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,qFAAqF;AACrF,KAAK,UAAU,QAAQ,CAAC,GAAiB;IACvC,OAAO,CAAC,MAAM,YAAY,CAAC,GAAG,EAAE,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACpF,CAAC;AAED,mGAAmG;AACnG,KAAK,UAAU,aAAa,CAAC,GAAiB;IAC5C,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC;IAC3F,MAAM,SAAS,CAAC,QAAQ,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,YAAY,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACzF,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAC9C,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACzD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,KAAK,CAAC,GAAiB;IACpC,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAClC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC5C,wFAAwF;IACxF,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnF,MAAM,MAAM,GAAc,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,IAAI,CACR,EAAE,EACF;QACE,MAAM;QACN,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,QAAQ,EAAE,CAAC,IAAI,CAAC;QAChB,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,KAAK;QACd,aAAa,EAAE,KAAK;QACpB,SAAS,EAAE,KAAK;QAChB,GAAG,EAAE,IAAI;KACV,EACD;QACE,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;QACpC,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;QACxC,IAAI,EAAE,GAAG,EAAE,CAAC,SAAS;QACrB,KAAK,EAAE,GAAG,EAAE,CAAC,SAAS;QACtB,QAAQ,EAAE,GAAG,EAAE,CAAC,SAAS;QACzB,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS;KACxB,CACF,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,WAAW,CAAC,kBAAkB,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAClF,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,MAAM,aAAa,GAAU;IAClC,EAAE,EAAE,eAAe;IACnB,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,MAAM;IACb,KAAK,EAAE,QAAQ;IACf,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CACf,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC;IAC7F,GAAG,EAAE,KAAK;CACX,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAc;IACnC,IAAI,EAAE,aAAa;IACnB,KAAK,EAAE,MAAM;IACb,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC;IACrD,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CACd,gBAAgB,CACd,GAAG,CAAC,OAAO,EACX,GAAG,CAAC,MAAM,CAAC,OAAO,EAClB,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CACzD;IACH,SAAS,EAAE;QACT,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE,GAAG,EAAE,CAAC,0EAA0E;KAC1F;CACF,CAAC"}

package/dist/checks/infra/actionlint.js

@@ -0,0 +1,95 @@
+import { readFile, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { parse as parseYaml, stringify } from 'yaml';
+import { z } from 'zod';
+import { parseJson, sentence, toolFailed } from './report.js';
+import { EngineError } from '../../core/check.js';
+const PROJECT_CONFIGS = ['.github/actionlint.yaml', '.github/actionlint.yml'];
+const projectConfig = z.object({
+    'self-hosted-runner': z.object({ labels: z.array(z.string()).nullish() }).nullish(),
+    'config-variables': z.array(z.string()).nullish(),
+});
+function readYaml(text) {
+    try {
+        const value = parseYaml(text);
+        return value;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * The config the gate gives actionlint: of the project's own, only the self-hosted runners'
+ * labels and the configuration variables it declares. Its `paths` section, which can ignore
+ * errors, is left out.
+ */
+export function actionlintConfig(projectText) {
+    const parsed = projectConfig.safeParse(projectText === undefined ? {} : (readYaml(projectText) ?? {}));
+    const kept = {};
+    const labels = parsed.data?.['self-hosted-runner']?.labels;
+    const variables = parsed.data?.['config-variables'];
+    if (labels !== undefined && labels !== null)
+        kept['self-hosted-runner'] = { labels };
+    if (variables !== undefined && variables !== null)
+        kept['config-variables'] = variables;
+    return stringify(kept);
+}
+const error = z.object({
+    message: z.string(),
+    filepath: z.string(),
+    line: z.number().int(),
+    column: z.number().int(),
+    kind: z.string(),
+});
+const SHELLCHECK = /SC(\d+):\w+:\d+:\d+: (.+)$/;
+function toFinding(e) {
+    const location = { file: e.filepath, line: e.line, column: e.column };
+    const sc = e.kind === 'shellcheck' ? SHELLCHECK.exec(e.message) : null;
+    if (sc?.[1] !== undefined && sc[2] !== undefined) {
+        return {
+            rule: 'actionlint/shellcheck',
+            message: `SC${sc[1]}: ${sentence(sc[2])}`,
+            location,
+            docs: `https://www.shellcheck.net/wiki/SC${sc[1]}`,
+        };
+    }
+    return {
+        rule: `actionlint/${e.kind}`,
+        message: sentence(e.message),
+        location,
+        docs: 'https://github.com/rhysd/actionlint/blob/main/docs/checks.md',
+    };
+}
+/** actionlint's `{{json .}}` output as findings. */
+export function parseActionlint(stdout) {
+    const parsed = z.array(error).safeParse(parseJson(stdout, 'actionlint'));
+    if (!parsed.success)
+        throw new EngineError('actionlint printed JSON Talos cannot read');
+    return parsed.data.map(toFinding);
+}
+async function projectText(root) {
+    for (const path of PROJECT_CONFIGS) {
+        const text = await readFile(join(root, path), 'utf8').catch(() => undefined);
+        if (text !== undefined)
+            return text;
+    }
+    return undefined;
+}
+/** actionlint over the workflows, with shellcheck from `tools.lock` for their `run:` scripts. */
+export async function actionlint(ctx, workflows) {
+    if (workflows.length === 0)
+        return [];
+    const [tool, shellcheck] = await Promise.all([
+        ctx.tools.path('actionlint'),
+        ctx.tools.path('shellcheck'),
+    ]);
+    const config = join(ctx.scratch, 'actionlint.yaml');
+    await writeFile(config, actionlintConfig(await projectText(ctx.root)));
+    const args = ['-format', '{{json .}}', '-no-color', '-config-file', config];
+    const tools = [`-shellcheck=${shellcheck}`, '-pyflakes='];
+    const result = await ctx.exec(tool, [...args, ...tools, '--', ...workflows], { cwd: ctx.root });
+    if (result.code > 1)
+        throw toolFailed('actionlint', result);
+    return parseActionlint(result.stdout);
+}
+//# sourceMappingURL=actionlint.js.map

package/dist/checks/infra/actionlint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"actionlint.js","sourceRoot":"","sources":["../../../src/checks/infra/actionlint.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACrD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAIlD,MAAM,eAAe,GAAG,CAAC,yBAAyB,EAAE,wBAAwB,CAAC,CAAC;AAE9E,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,oBAAoB,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE;IACnF,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;CAClD,CAAC,CAAC;AAEH,SAAS,QAAQ,CAAC,IAAY;IAC5B,IAAI,CAAC;QACH,MAAM,KAAK,GAAY,SAAS,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,WAA+B;IAC9D,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CACpC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAC/D,CAAC;IACF,MAAM,IAAI,GAA4B,EAAE,CAAC;IACzC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC3D,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,kBAAkB,CAAC,CAAC;IACpD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI;QAAE,IAAI,CAAC,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC;IACrF,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,IAAI;QAAE,IAAI,CAAC,kBAAkB,CAAC,GAAG,SAAS,CAAC;IACxF,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC;IACrB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACtB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACxB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;CACjB,CAAC,CAAC;AAEH,MAAM,UAAU,GAAG,4BAA4B,CAAC;AAEhD,SAAS,SAAS,CAAC,CAAwB;IACzC,MAAM,QAAQ,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IACtE,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACvE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QACjD,OAAO;YACL,IAAI,EAAE,uBAAuB;YAC7B,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE;YACzC,QAAQ;YACR,IAAI,EAAE,qCAAqC,EAAE,CAAC,CAAC,CAAC,EAAE;SACnD,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,cAAc,CAAC,CAAC,IAAI,EAAE;QAC5B,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;QAC5B,QAAQ;QACR,IAAI,EAAE,8DAA8D;KACrE,CAAC;AACJ,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;IACzE,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,WAAW,CAAC,2CAA2C,CAAC,CAAC;IACxF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;AACpC,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAY;IACrC,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC7E,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;IACtC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,iGAAiG;AACjG,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,GAAiB,EACjB,SAA4B;IAE5B,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACtC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC3C,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC;QAC5B,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC;KAC7B,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;IACpD,MAAM,SAAS,CAAC,MAAM,EAAE,gBAAgB,CAAC,MAAM,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvE,MAAM,IAAI,GAAG,CAAC,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC;IAC5E,MAAM,KAAK,GAAG,CAAC,eAAe,UAAU,EAAE,EAAE,YAAY,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,GAAG,SAAS,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAChG,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC;QAAE,MAAM,UAAU,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAC5D,OAAO,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AACxC,CAAC"}

package/dist/checks/infra/configs.js

@@ -0,0 +1,52 @@
+import { hadolintSettings } from './dockerfile.js';
+import { dockerfiles, namedShellScripts, powershellFiles, PSSA_SETTINGS, shebangCandidates, } from './files.js';
+import { pssaSettings } from './powershell.js';
+import { SHELLCHECK_DISABLE, SHELLCHECK_ENABLE } from './shell.js';
+import { generatedHeader } from '../../configs/header.js';
+export const SHELLCHECK_RC = '.shellcheckrc';
+export const HADOLINT_CONFIG = '.hadolint.yaml';
+/** Whether the repository may hold shell scripts; their first lines decide the rest. */
+export function mayHaveShellScripts(files) {
+    return namedShellScripts(files).length > 0 || shebangCandidates(files).length > 0;
+}
+export function renderShellcheckrc(version) {
+    return [
+        generatedHeader('#', version).trimEnd(),
+        `enable=${SHELLCHECK_ENABLE}`,
+        `disable=${SHELLCHECK_DISABLE}`,
+        'external-sources=true',
+        'source-path=SCRIPTDIR',
+        '',
+    ].join('\n');
+}
+export function renderHadolint(version) {
+    return `${generatedHeader('#', version)}${hadolintSettings()}`;
+}
+export function renderPssaSettings(version) {
+    return `${generatedHeader('#', version)}${pssaSettings()}`;
+}
+/**
+ * The bases editors read. None has an extension file: every rule is already on, and none of
+ * these tools reads a second file. The gate passes the same settings itself.
+ */
+export const INFRA_GENERATED = [
+    {
+        path: SHELLCHECK_RC,
+        scope: 'repo',
+        applies: (ctx) => mayHaveShellScripts(ctx.facts.files),
+        render: (ctx) => renderShellcheckrc(ctx.version),
+    },
+    {
+        path: HADOLINT_CONFIG,
+        scope: 'repo',
+        applies: (ctx) => dockerfiles(ctx.facts.files).length > 0,
+        render: (ctx) => renderHadolint(ctx.version),
+    },
+    {
+        path: PSSA_SETTINGS,
+        scope: 'repo',
+        applies: (ctx) => powershellFiles(ctx.facts.files).length > 0,
+        render: (ctx) => renderPssaSettings(ctx.version),
+    },
+];
+//# sourceMappingURL=configs.js.map

package/dist/checks/infra/configs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"configs.js","sourceRoot":"","sources":["../../../src/checks/infra/configs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EACL,WAAW,EACX,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,iBAAiB,GAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAI1D,MAAM,CAAC,MAAM,aAAa,GAAG,eAAe,CAAC;AAC7C,MAAM,CAAC,MAAM,eAAe,GAAG,gBAAgB,CAAC;AAEhD,wFAAwF;AACxF,MAAM,UAAU,mBAAmB,CAAC,KAAwB;IAC1D,OAAO,iBAAiB,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,iBAAiB,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AACpF,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,OAAO;QACL,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,OAAO,EAAE;QACvC,UAAU,iBAAiB,EAAE;QAC7B,WAAW,kBAAkB,EAAE;QAC/B,uBAAuB;QACvB,uBAAuB;QACvB,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,OAAO,GAAG,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,gBAAgB,EAAE,EAAE,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,OAAO,GAAG,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,YAAY,EAAE,EAAE,CAAC;AAC7D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAyB;IACnD;QACE,IAAI,EAAE,aAAa;QACnB,KAAK,EAAE,MAAM;QACb,OAAO,EAAE,CAAC,GAAiB,EAAE,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC;QACpE,MAAM,EAAE,CAAC,GAAkB,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC;KAChE;IACD;QACE,IAAI,EAAE,eAAe;QACrB,KAAK,EAAE,MAAM;QACb,OAAO,EAAE,CAAC,GAAiB,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC;QACvE,MAAM,EAAE,CAAC,GAAkB,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC;KAC5D;IACD;QACE,IAAI,EAAE,aAAa;QACnB,KAAK,EAAE,MAAM;QACb,OAAO,EAAE,CAAC,GAAiB,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC;QAC3E,MAAM,EAAE,CAAC,GAAkB,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC;KAChE;CACF,CAAC"}

package/dist/checks/infra/dockerfile.js

@@ -0,0 +1,69 @@
+import { writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { z } from 'zod';
+import { batches, dockerfiles } from './files.js';
+import { parseJson, sentence, toolFailed } from './report.js';
+import { EngineError } from '../../core/check.js';
+/** Everything hadolint reports down to `info` is a finding; `style` and `ignore` are not. */
+const COUNTED = new Set(['error', 'warning', 'info']);
+/** hadolint's settings, which the generated `.hadolint.yaml` and the gate share. */
+export function hadolintSettings() {
+    return 'failure-threshold: info\n';
+}
+const result = z.object({
+    code: z.string(),
+    file: z.string(),
+    line: z.number().int(),
+    column: z.number().int(),
+    level: z.string(),
+    message: z.string(),
+});
+function docsFor(code) {
+    return code.startsWith('SC')
+        ? `https://www.shellcheck.net/wiki/${code}`
+        : `https://github.com/hadolint/hadolint/wiki/${code}`;
+}
+/** hadolint's JSON output as findings. */
+export function parseHadolint(stdout) {
+    const parsed = z.array(result).safeParse(parseJson(stdout, 'hadolint'));
+    if (!parsed.success)
+        throw new EngineError('hadolint printed JSON Talos cannot read');
+    return parsed.data
+        .filter((r) => COUNTED.has(r.level))
+        .map((r) => ({
+        rule: `hadolint/${r.code}`,
+        message: sentence(r.message),
+        location: { file: r.file, line: r.line, column: r.column },
+        docs: docsFor(r.code),
+    }));
+}
+/**
+ * hadolint over every Dockerfile and Containerfile, with the settings Talos writes into its
+ * scratch directory: the repository's `.hadolint.yaml` plays no part in the gate.
+ */
+export async function dockerfile(ctx) {
+    const files = dockerfiles(ctx.facts.files);
+    if (files.length === 0)
+        return [];
+    const hadolint = await ctx.tools.path('hadolint');
+    const config = join(ctx.scratch, 'hadolint.yaml');
+    await writeFile(config, hadolintSettings());
+    const args = [
+        '--config',
+        config,
+        '--format',
+        'json',
+        '--failure-threshold',
+        'info',
+        '--no-color',
+    ];
+    const findings = [];
+    for (const batch of batches(files)) {
+        const run = await ctx.exec(hadolint, [...args, '--', ...batch], { cwd: ctx.root });
+        if (run.code > 1)
+            throw toolFailed('hadolint', run);
+        findings.push(...parseHadolint(run.stdout));
+    }
+    return findings;
+}
+//# sourceMappingURL=dockerfile.js.map

package/dist/checks/infra/dockerfile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dockerfile.js","sourceRoot":"","sources":["../../../src/checks/infra/dockerfile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAIlD,6FAA6F;AAC7F,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;AAEtD,oFAAoF;AACpF,MAAM,UAAU,gBAAgB;IAC9B,OAAO,2BAA2B,CAAC;AACrC,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IACtB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACtB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACxB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;CACpB,CAAC,CAAC;AAEH,SAAS,OAAO,CAAC,IAAY;IAC3B,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,CAAC,CAAC,mCAAmC,IAAI,EAAE;QAC3C,CAAC,CAAC,6CAA6C,IAAI,EAAE,CAAC;AAC1D,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,aAAa,CAAC,MAAc;IAC1C,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IACxE,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,WAAW,CAAC,yCAAyC,CAAC,CAAC;IACtF,OAAO,MAAM,CAAC,IAAI;SACf,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;SACnC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACX,IAAI,EAAE,YAAY,CAAC,CAAC,IAAI,EAAE;QAC1B,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;QAC5B,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;QAC1D,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;KACtB,CAAC,CAAC,CAAC;AACR,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAiB;IAChD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAClC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAClD,MAAM,SAAS,CAAC,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG;QACX,UAAU;QACV,MAAM;QACN,UAAU;QACV,MAAM;QACN,qBAAqB;QACrB,MAAM;QACN,YAAY;KACb,CAAC;IACF,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACnF,IAAI,GAAG,CAAC,IAAI,GAAG,CAAC;YAAE,MAAM,UAAU,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QACpD,QAAQ,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/checks/infra/files.js

@@ -0,0 +1,123 @@
+import { open } from 'node:fs/promises';
+import { join, posix } from 'node:path';
+/** The base config the PowerShell check writes; it is Talos's, so it is never analysed. */
+export const PSSA_SETTINGS = 'PSScriptAnalyzerSettings.psd1';
+/** Names that are never scripts, though they have no extension. */
+const NOT_SCRIPTS = new Set([
+    'AUTHORS',
+    'Brewfile',
+    'CHANGELOG',
+    'CODEOWNERS',
+    'COPYING',
+    'Containerfile',
+    'Dockerfile',
+    'GNUmakefile',
+    'Gemfile',
+    'Jenkinsfile',
+    'Justfile',
+    'LICENCE',
+    'LICENSE',
+    'Makefile',
+    'NOTICE',
+    'OWNERS',
+    'Pipfile',
+    'Procfile',
+    'README',
+    'Rakefile',
+    'VERSION',
+    'Vagrantfile',
+    'justfile',
+    'makefile',
+]);
+/** The shells shellcheck understands, as a shebang names them. */
+const SHELLS = new Set(['sh', 'bash', 'dash', 'ksh', 'busybox']);
+/** Scripts named as shell scripts. */
+export function namedShellScripts(files) {
+    return files.filter((file) => /\.(sh|bash)$/.test(file));
+}
+/** Files with no extension that may be scripts, which their first line decides. */
+export function shebangCandidates(files) {
+    return files.filter((file) => {
+        const name = posix.basename(file);
+        return !name.includes('.') && !NOT_SCRIPTS.has(name);
+    });
+}
+/** The shell a script's first line names, directly or through `env`, if shellcheck reads it. */
+export function shellOf(firstLine) {
+    const match = /^#!\s*(\S.*)$/.exec(firstLine.trim());
+    if (match?.[1] === undefined)
+        return undefined;
+    const words = match[1].split(/\s+/);
+    const program = posix.basename(words[0] ?? '');
+    const shell = program === 'env'
+        ? words.slice(1).find((w) => !w.startsWith('-') && !w.includes('='))
+        : program;
+    return shell !== undefined && SHELLS.has(shell) ? shell : undefined;
+}
+/** A file's first line, or nothing when it can't be read. */
+export async function firstLine(root, file) {
+    try {
+        const handle = await open(join(root, file), 'r');
+        try {
+            const buffer = Buffer.alloc(256);
+            const { bytesRead } = await handle.read(buffer, 0, buffer.length, 0);
+            return buffer.subarray(0, bytesRead).toString('utf8').split('\n')[0] ?? '';
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    catch {
+        return '';
+    }
+}
+/** Every shell script: those named so, and the extensionless ones whose shebang names a shell. */
+export async function shellScripts(root, files) {
+    const candidates = shebangCandidates(files);
+    const lines = await Promise.all(candidates.map((file) => firstLine(root, file)));
+    const found = candidates.filter((_, index) => shellOf(lines[index] ?? '') !== undefined);
+    return [...namedShellScripts(files), ...found].sort((a, b) => a.localeCompare(b));
+}
+/** The names Docker and Podman look for: `Dockerfile`, Docker's `dockerfile`, `Containerfile`. */
+const CONTAINER_FILE = /^(?:Dockerfile|dockerfile|Containerfile)$/;
+/** One of them with a suffix: `Dockerfile.prod`, `Containerfile.dev`. */
+const SUFFIXED = /^(?:Dockerfile|Containerfile)\../;
+/** A name with one as its extension: `api.Dockerfile`, `api.dockerfile`, `api.Containerfile`. */
+const EXTENSION = /.\.(?:Dockerfile|dockerfile|Containerfile|containerfile)$/;
+/**
+ * Whether a path is a Dockerfile or a Containerfile, named as Docker and Podman name them, in
+ * their case: a source file such as `dockerfile.ts` is not one, nor is an ignore file such as
+ * `Dockerfile.dockerignore`.
+ */
+export function isDockerfile(path) {
+    const name = posix.basename(path);
+    if (name.endsWith('.dockerignore'))
+        return false;
+    return CONTAINER_FILE.test(name) || SUFFIXED.test(name) || EXTENSION.test(name);
+}
+export function dockerfiles(files) {
+    return files.filter((file) => isDockerfile(file));
+}
+export function powershellFiles(files) {
+    return files.filter((file) => /\.(ps1|psm1|psd1)$/i.test(file) && file !== PSSA_SETTINGS);
+}
+/** Workflows GitHub runs: YAML directly in `.github/workflows`. */
+export function workflowFiles(files) {
+    return files.filter((file) => /^\.github\/workflows\/[^/]+\.ya?ml$/.test(file));
+}
+/** Action definitions anywhere in the repository. */
+export function actionFiles(files) {
+    return files.filter((file) => /(^|\/)action\.ya?ml$/.test(file));
+}
+export function dependabotFiles(files) {
+    return files.filter((file) => /^\.github\/dependabot\.ya?ml$/.test(file));
+}
+/** Splits a list of files into runs short enough for any command line. */
+export function batches(items, size = 200) {
+    const out = [];
+    for (let start = 0; start < items.length; start += size) {
+        out.push(items.slice(start, start + size));
+    }
+    return out;
+}
+//# sourceMappingURL=files.js.map

package/dist/checks/infra/files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"files.js","sourceRoot":"","sources":["../../../src/checks/infra/files.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAExC,2FAA2F;AAC3F,MAAM,CAAC,MAAM,aAAa,GAAG,+BAA+B,CAAC;AAE7D,mEAAmE;AACnE,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC;IAC1B,SAAS;IACT,UAAU;IACV,WAAW;IACX,YAAY;IACZ,SAAS;IACT,eAAe;IACf,YAAY;IACZ,aAAa;IACb,SAAS;IACT,aAAa;IACb,UAAU;IACV,SAAS;IACT,SAAS;IACT,UAAU;IACV,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,UAAU;IACV,QAAQ;IACR,UAAU;IACV,SAAS;IACT,aAAa;IACb,UAAU;IACV,UAAU;CACX,CAAC,CAAC;AAEH,kEAAkE;AAClE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;AAEjE,sCAAsC;AACtC,MAAM,UAAU,iBAAiB,CAAC,KAAwB;IACxD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,iBAAiB,CAAC,KAAwB;IACxD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;QAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAClC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,OAAO,CAAC,SAAiB;IACvC,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;IACrD,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC/C,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/C,MAAM,KAAK,GACT,OAAO,KAAK,KAAK;QACf,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACpE,CAAC,CAAC,OAAO,CAAC;IACd,OAAO,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACtE,CAAC;AAED,6DAA6D;AAC7D,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAY,EAAE,IAAY;IACxD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;QACjD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YACrE,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7E,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,kGAAkG;AAClG,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY,EAAE,KAAwB;IACvE,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACjF,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,SAAS,CAAC,CAAC;IACzF,OAAO,CAAC,GAAG,iBAAiB,CAAC,KAAK,CAAC,EAAE,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;AACpF,CAAC;AAED,kGAAkG;AAClG,MAAM,cAAc,GAAG,2CAA2C,CAAC;AACnE,yEAAyE;AACzE,MAAM,QAAQ,GAAG,kCAAkC,CAAC;AACpD,iGAAiG;AACjG,MAAM,SAAS,GAAG,2DAA2D,CAAC;AAE9E;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC;QAAE,OAAO,KAAK,CAAC;IACjD,OAAO,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAClF,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAwB;IAClD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAwB;IACtD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,aAAa,CAAC,CAAC;AAC5F,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,aAAa,CAAC,KAAwB;IACpD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,qCAAqC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAClF,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,WAAW,CAAC,KAAwB;IAClD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAwB;IACtD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,OAAO,CAAI,KAAmB,EAAE,IAAI,GAAG,GAAG;IACxD,MAAM,GAAG,GAAU,EAAE,CAAC;IACtB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,IAAI,EAAE,CAAC;QACxD,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/checks/infra/index.js

@@ -0,0 +1,59 @@
+import { actionlint } from './actionlint.js';
+import { INFRA_GENERATED, mayHaveShellScripts } from './configs.js';
+import { dockerfile } from './dockerfile.js';
+import { actionFiles, dependabotFiles, dockerfiles, powershellFiles, workflowFiles, } from './files.js';
+import { powershell } from './powershell.js';
+import { shell } from './shell.js';
+import { zizmor } from './zizmor.js';
+import { APPLIES, skip, } from '../../core/check.js';
+function zizmorInputs(files) {
+    return [...workflowFiles(files), ...actionFiles(files), ...dependabotFiles(files)];
+}
+/** actionlint for correctness, then zizmor for security. */
+async function workflows(ctx) {
+    const files = ctx.facts.files;
+    const correctness = await actionlint(ctx, workflowFiles(files));
+    const security = await zizmor(ctx, zizmorInputs(files));
+    return [...correctness, ...security];
+}
+const REPO = { tier: 'head', scope: 'repo' };
+const checks = [
+    {
+        ...REPO,
+        id: 'infra/shell',
+        title: 'shellcheck, every optional check but SC2250',
+        applies: (ctx) => mayHaveShellScripts(ctx.facts.files) ? APPLIES : skip('the repository has no shell scripts'),
+        run: shell,
+    },
+    {
+        ...REPO,
+        id: 'infra/powershell',
+        title: 'PSScriptAnalyzer, every rule at every severity',
+        applies: (ctx) => powershellFiles(ctx.facts.files).length > 0
+            ? APPLIES
+            : skip('the repository has no PowerShell files'),
+        run: powershell,
+    },
+    {
+        ...REPO,
+        id: 'infra/dockerfile',
+        title: 'hadolint, down to info',
+        applies: (ctx) => dockerfiles(ctx.facts.files).length > 0 ? APPLIES : skip('the repository has no Dockerfile'),
+        run: dockerfile,
+    },
+    {
+        ...REPO,
+        id: 'infra/workflows',
+        title: 'actionlint, and zizmor at its pedantic persona',
+        applies: (ctx) => zizmorInputs(ctx.facts.files).length > 0
+            ? APPLIES
+            : skip('the repository has no workflows, actions or Dependabot config'),
+        run: workflows,
+    },
+];
+export const infraPack = {
+    name: 'infra',
+    checks,
+    generated: INFRA_GENERATED,
+};
+//# sourceMappingURL=index.js.map

package/dist/checks/infra/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/checks/infra/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EACL,WAAW,EACX,eAAe,EACf,WAAW,EACX,eAAe,EACf,aAAa,GACd,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAEL,OAAO,EAGP,IAAI,GACL,MAAM,qBAAqB,CAAC;AAI7B,SAAS,YAAY,CAAC,KAAwB;IAC5C,OAAO,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,EAAE,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;AACrF,CAAC;AAED,4DAA4D;AAC5D,KAAK,UAAU,SAAS,CAAC,GAAiB;IACxC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC;IAC9B,MAAM,WAAW,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IACxD,OAAO,CAAC,GAAG,WAAW,EAAE,GAAG,QAAQ,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAW,CAAC;AAEtD,MAAM,MAAM,GAAY;IACtB;QACE,GAAG,IAAI;QACP,EAAE,EAAE,aAAa;QACjB,KAAK,EAAE,6CAA6C;QACpD,OAAO,EAAE,CAAC,GAAiB,EAAE,EAAE,CAC7B,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC;QAC9F,GAAG,EAAE,KAAK;KACX;IACD;QACE,GAAG,IAAI;QACP,EAAE,EAAE,kBAAkB;QACtB,KAAK,EAAE,gDAAgD;QACvD,OAAO,EAAE,CAAC,GAAiB,EAAE,EAAE,CAC7B,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC;YACzC,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,IAAI,CAAC,wCAAwC,CAAC;QACpD,GAAG,EAAE,UAAU;KAChB;IACD;QACE,GAAG,IAAI;QACP,EAAE,EAAE,kBAAkB;QACtB,KAAK,EAAE,wBAAwB;QAC/B,OAAO,EAAE,CAAC,GAAiB,EAAE,EAAE,CAC7B,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,kCAAkC,CAAC;QAC9F,GAAG,EAAE,UAAU;KAChB;IACD;QACE,GAAG,IAAI;QACP,EAAE,EAAE,iBAAiB;QACrB,KAAK,EAAE,gDAAgD;QACvD,OAAO,EAAE,CAAC,GAAiB,EAAE,EAAE,CAC7B,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC;YACtC,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,IAAI,CAAC,+DAA+D,CAAC;QAC3E,GAAG,EAAE,SAAS;KACf;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,SAAS,GAAS;IAC7B,IAAI,EAAE,OAAO;IACb,MAAM;IACN,SAAS,EAAE,eAAe;CAC3B,CAAC"}

package/dist/checks/infra/powershell.js

@@ -0,0 +1,128 @@
+import { readFile, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { z } from 'zod';
+import { powershellFiles } from './files.js';
+import { parseJson, sentence, toolFailed } from './report.js';
+import { EngineError } from '../../core/check.js';
+/**
+ * PSScriptAnalyzer's settings: every rule at every severity, parse errors included, and the
+ * formatting rules that are off by default, at two spaces with braces on the same line.
+ */
+export function pssaSettings() {
+    return [
+        '@{',
+        "  Severity = @('Error', 'Warning', 'Information', 'ParseError')",
+        '  IncludeDefaultRules = $true',
+        '  Rules = @{',
+        '    PSAvoidExclaimOperator = @{ Enable = $true }',
+        '    PSAvoidSemicolonsAsLineTerminators = @{ Enable = $true }',
+        '    PSPlaceCloseBrace = @{ Enable = $true; IgnoreOneLineBlock = $true }',
+        '    PSPlaceOpenBrace = @{ Enable = $true; OnSameLine = $true; IgnoreOneLineBlock = $true }',
+        '    PSUseConsistentIndentation = @{',
+        '      Enable = $true',
+        '      IndentationSize = 2',
+        "      Kind = 'space'",
+        "      PipelineIndentation = 'IncreaseIndentationForFirstPipeline'",
+        '    }',
+        '    PSUseConsistentWhitespace = @{ Enable = $true }',
+        '    PSUseCorrectCasing = @{ Enable = $true }',
+        '  }',
+        '}',
+        '',
+    ].join('\n');
+}
+/**
+ * Analyses each listed file with the module imported by path, and writes the results as JSON,
+ * each naming the file as listed.
+ */
+const PSSA_RUNNER = String.raw `param(
+  [Parameter(Mandatory)][string] $Module,
+  [Parameter(Mandatory)][string] $Settings,
+  [Parameter(Mandatory)][string] $List,
+  [Parameter(Mandatory)][string] $Out
+)
+$ErrorActionPreference = 'Stop'
+Import-Module -Name $Module -Force
+$records = @(
+  foreach ($file in Get-Content -LiteralPath $List) {
+    foreach ($record in Invoke-ScriptAnalyzer -Path $file -Settings $Settings) {
+      [ordered]@{
+        rule = $record.RuleName
+        file = $file
+        line = $record.Line
+        endLine = if ($record.Extent) { $record.Extent.EndLineNumber } else { $null }
+        column = $record.Column
+        message = $record.Message
+      }
+    }
+  }
+)
+ConvertTo-Json -InputObject $records -Depth 3 | Set-Content -LiteralPath $Out -Encoding utf8
+`;
+const record = z.object({
+    rule: z.string(),
+    file: z.string(),
+    line: z.number().int(),
+    endLine: z.number().int().nullable(),
+    column: z.number().int().nullable(),
+    message: z.string(),
+});
+function docsFor(rule) {
+    return rule.startsWith('PS')
+        ? `https://learn.microsoft.com/powershell/utility-modules/psscriptanalyzer/rules/${rule.slice(2)}`
+        : undefined;
+}
+/** The runner's JSON as findings. */
+export function parsePssa(text) {
+    const parsed = z.array(record).safeParse(parseJson(text, 'PSScriptAnalyzer'));
+    if (!parsed.success)
+        throw new EngineError('PSScriptAnalyzer wrote JSON Talos cannot read');
+    return parsed.data.map((r) => {
+        const docs = docsFor(r.rule);
+        return {
+            rule: `psscriptanalyzer/${r.rule}`,
+            message: sentence(r.message),
+            location: {
+                file: r.file,
+                line: r.line,
+                ...(r.endLine !== null && r.endLine > r.line ? { endLine: r.endLine } : {}),
+                ...(r.column === null ? {} : { column: r.column }),
+            },
+            ...(docs === undefined ? {} : { docs }),
+        };
+    });
+}
+async function pwsh(ctx, args) {
+    try {
+        return await ctx.exec('pwsh', args, {
+            cwd: ctx.root,
+            env: { NO_COLOR: '1', POWERSHELL_TELEMETRY_OPTOUT: '1', POWERSHELL_UPDATECHECK: 'Off' },
+        });
+    }
+    catch (error) {
+        const reason = error instanceof Error ? error.message : String(error);
+        throw new EngineError(`infra/powershell needs PowerShell 7 (pwsh) on PATH: ${reason}`);
+    }
+}
+/**
+ * PSScriptAnalyzer from `tools.lock`, run through pwsh with the settings Talos writes into its
+ * scratch directory, over every `.ps1`, `.psm1` and `.psd1` but the generated settings file.
+ */
+export async function powershell(ctx) {
+    const files = powershellFiles(ctx.facts.files);
+    if (files.length === 0)
+        return [];
+    const module = await ctx.tools.path('psscriptanalyzer');
+    const at = (name) => join(ctx.scratch, name);
+    await writeFile(at('settings.psd1'), pssaSettings());
+    await writeFile(at('analyse.ps1'), PSSA_RUNNER);
+    await writeFile(at('files.txt'), `${files.join('\n')}\n`);
+    const args = ['-NoProfile', '-NonInteractive', '-File', at('analyse.ps1'), '-Module', module];
+    const more = ['-Settings', at('settings.psd1'), '-List', at('files.txt'), '-Out', at('out.json')];
+    const result = await pwsh(ctx, [...args, ...more]);
+    if (result.code !== 0)
+        throw toolFailed('PSScriptAnalyzer', result);
+    const text = await readFile(at('out.json'), 'utf8').catch(() => '');
+    return parsePssa(text);
+}
+//# sourceMappingURL=powershell.js.map