actions-warden 0.2.0 → 0.3.0

package/src/lib/patcher.js

@@ -0,0 +1,199 @@
+/**
+ * Apply non-overlapping source patches from right to left.
+ *
+ * @param {string} source
+ * @param {Array<{start: number, end: number, text: string, expected?: string}>} patches
+ */
+export function applyPatches(source, patches) {
+  const ordered = [...patches].sort((a, b) => b.start - a.start || b.end - a.end);
+  let previousStart = source.length + 1;
+  let output = source;
+
+  for (const patch of ordered) {
+    if (
+      !Number.isInteger(patch.start)
+      || !Number.isInteger(patch.end)
+      || patch.start < 0
+      || patch.end < patch.start
+      || patch.end > source.length
+    ) {
+      throw new Error('invalid source patch range');
+    }
+    if (patch.end > previousStart) {
+      throw new Error('overlapping source patches');
+    }
+    if (
+      patch.expected !== undefined
+      && source.slice(patch.start, patch.end) !== patch.expected
+    ) {
+      throw new Error('workflow changed while planning; refusing to apply stale patch');
+    }
+    output = output.slice(0, patch.start) + patch.text + output.slice(patch.end);
+    previousStart = patch.start;
+  }
+  return output;
+}
+
+/**
+ * Locate a parsed action reference when callers constructed it without ranges.
+ *
+ * @param {string} source
+ * @param {{raw: string, line: number, start?: number, end?: number, lineStart?: number, lineEnd?: number}} ref
+ */
+export function locateActionRef(source, ref) {
+  if (
+    Number.isInteger(ref.start)
+    && Number.isInteger(ref.end)
+    && ref.end > ref.start
+    && (
+      source.slice(ref.start, ref.end).includes(ref.raw)
+      || ref.alias === true
+    )
+  ) {
+    const lineStart = (
+      Number.isInteger(ref.lineStart)
+      && ref.lineStart <= ref.start
+      && !source.slice(ref.lineStart, ref.start).includes('\n')
+    )
+      ? ref.lineStart
+      : source.lastIndexOf('\n', Math.max(ref.start - 1, 0)) + 1;
+    const newline = source.indexOf('\n', ref.end);
+    const computedLineEnd = newline === -1 ? source.length : newline;
+    const lineEnd = Number.isInteger(ref.lineEnd) && ref.lineEnd >= ref.end
+      ? ref.lineEnd
+      : computedLineEnd;
+    return {
+      ...ref,
+      lineStart,
+      lineEnd,
+      column: Number.isInteger(ref.column) && ref.column > 0
+        ? ref.column
+        : ref.start - lineStart + 1,
+    };
+  }
+
+  const lines = source.split('\n');
+  const lineIndex = Math.max((ref.line || 1) - 1, 0);
+  let lineStart = 0;
+  for (let i = 0; i < lineIndex; i += 1) lineStart += lines[i].length + 1;
+  const lineText = lines[lineIndex] ?? '';
+  const relativeStart = lineText.indexOf(ref.raw);
+  if (relativeStart === -1) {
+    throw new Error(`could not locate uses reference on line ${ref.line}`);
+  }
+  let start = lineStart + relativeStart;
+  let end = start + ref.raw.length;
+  const before = source[start - 1];
+  const after = source[end];
+  if ((before === '"' || before === "'") && after === before) {
+    start -= 1;
+    end += 1;
+  }
+  return {
+    ...ref,
+    start,
+    end,
+    lineStart,
+    lineEnd: lineStart + lineText.length,
+    column: start - lineStart + 1,
+  };
+}
+
+/**
+ * Build exact patches for one `uses:` scalar and its version metadata.
+ *
+ * @param {string} source
+ * @param {object} ref
+ * @param {string} ref.raw
+ * @param {string} ref.owner
+ * @param {string} ref.repo
+ * @param {string|null} ref.subpath
+ * @param {number} ref.start
+ * @param {number} ref.end
+ * @param {number} ref.lineEnd
+ * @param {string} newRef
+ * @param {string} versionLabel
+ */
+export function planUsesPatches(source, ref, newRef, versionLabel) {
+  const located = locateActionRef(source, ref);
+  const left = located.subpath
+    ? `${located.owner}/${located.repo}/${located.subpath}`
+    : `${located.owner}/${located.repo}`;
+  const nextValue = `${left}@${newRef}`;
+  const originalScalar = source.slice(located.start, located.end);
+  const quote = originalScalar[0] === '"' || originalScalar[0] === "'"
+    ? originalScalar[0]
+    : '';
+  const scalarText = quote ? `${quote}${nextValue}${quote}` : nextValue;
+  const patches = [{
+    start: located.start,
+    end: located.end,
+    text: scalarText,
+    expected: originalScalar,
+  }];
+
+  if (versionLabel) {
+    const commentPatch = planVersionCommentPatch(source, located, versionLabel);
+    if (commentPatch) patches.push(commentPatch);
+  }
+  return patches;
+}
+
+/**
+ * Read version metadata from either the new marker or the legacy `# v1.2.3`
+ * comment format.
+ *
+ * @param {string} source
+ * @param {object} ref
+ */
+export function readVersionComment(source, ref) {
+  const located = locateActionRef(source, ref);
+  const trailing = source.slice(located.end, located.lineEnd);
+  const marker = trailing.match(/\bactions-warden-ref:\s*([^\s;#]+)/i);
+  if (marker) return marker[1];
+  const legacy = trailing.match(/^\s*#\s*(v?\d+(?:\.\d+){0,2}(?:-[0-9A-Za-z.-]+)?)\s*$/);
+  return legacy ? legacy[1] : null;
+}
+
+function planVersionCommentPatch(source, ref, versionLabel) {
+  const trailing = source.slice(ref.end, ref.lineEnd);
+  const marker = /\bactions-warden-ref:\s*([^\s;#]+)/i.exec(trailing);
+  if (marker) {
+    const valueOffset = marker.index + marker[0].lastIndexOf(marker[1]);
+    return {
+      start: ref.end + valueOffset,
+      end: ref.end + valueOffset + marker[1].length,
+      text: versionLabel,
+      expected: marker[1],
+    };
+  }
+
+  const legacy = /^(\s*#\s*)(v?\d+(?:\.\d+){0,2}(?:-[0-9A-Za-z.-]+)?)(\s*)$/.exec(trailing);
+  if (legacy) {
+    const valueOffset = legacy[1].length;
+    return {
+      start: ref.end + valueOffset,
+      end: ref.end + valueOffset + legacy[2].length,
+      text: versionLabel,
+      expected: legacy[2],
+    };
+  }
+
+  const hashOffset = trailing.indexOf('#');
+  if (hashOffset === -1) {
+    return {
+      start: ref.end,
+      end: ref.end,
+      text: ` # actions-warden-ref: ${versionLabel}`,
+      expected: '',
+    };
+  }
+
+  const insertAt = ref.end + hashOffset + 1;
+  return {
+    start: insertAt,
+    end: insertAt,
+    text: ` actions-warden-ref: ${versionLabel};`,
+    expected: '',
+  };
+}

package/src/lib/paths.js

@@ -2,12 +2,12 @@
  * Workflow file discovery with safe path handling.
  */
 
-import { readdir, stat } from 'node:fs/promises';
-import { resolve, join, relative } from 'node:path';
+import { readdir, stat, realpath } from 'node:fs/promises';
+import { resolve, join, relative, isAbsolute, sep } from 'node:path';
 import picomatch from 'picomatch';
 
 /**
- * Default workflow and composite-action globs.
+ * Default workflow directory globs.
  */
 export const DEFAULT_WORKFLOW_PATTERNS = [
   '.github/workflows/*.yml',
@@ -25,14 +25,30 @@ export const DEFAULT_WORKFLOW_PATTERNS = [
  * @param {string} cwd
  */
 function assertInside(p, cwd) {
+  if (typeof p !== 'string' || p.includes('\0')) {
+    throw new Error('invalid workflow path');
+  }
+  const root = resolve(cwd);
   const abs = resolve(cwd, p);
-  const rel = relative(cwd, abs);
-  if (rel.startsWith('..') || rel.includes('\0')) {
+  const rel = relative(root, abs);
+  if (isOutside(rel)) {
     throw new Error(`path traversal rejected: ${p}`);
   }
   return abs;
 }
 
+function isOutside(rel) {
+  return rel === '..' || rel.startsWith(`..${sep}`) || isAbsolute(rel);
+}
+
+async function assertRealInside(path, cwd) {
+  const [root, target] = await Promise.all([realpath(resolve(cwd)), realpath(path)]);
+  if (isOutside(relative(root, target))) {
+    throw new Error(`symlink escape rejected: ${path}`);
+  }
+  return target;
+}
+
 /**
  * Recursively list files under a directory.
  *
@@ -69,12 +85,17 @@ async function walk(dir, acc = []) {
  * @returns {Promise<string[]>}
  */
 export async function discoverWorkflows({ patterns = DEFAULT_WORKFLOW_PATTERNS, cwd = process.cwd() } = {}) {
-  for (const p of patterns) assertInside(p, cwd);
-  const matchers = patterns.map(p => picomatch(p, { dot: true }));
-  const all = await walk(cwd);
+  const root = resolve(cwd);
+  for (const p of patterns) assertInside(p, root);
+  const normalizedPatterns = patterns.map(p => {
+    const pattern = isAbsolute(p) ? relative(root, p) : p;
+    return pattern.split(sep).join('/');
+  });
+  const matchers = normalizedPatterns.map(p => picomatch(p, { dot: true }));
+  const all = await walk(root);
   const out = [];
   for (const file of all) {
-    const rel = relative(cwd, file);
+    const rel = relative(root, file).split(sep).join('/');
     if (matchers.some(m => m(rel))) out.push(file);
   }
   return out.sort();
@@ -92,11 +113,13 @@ export async function resolveWorkflowArg(input, cwd = process.cwd()) {
   const abs = assertInside(input, cwd);
   try {
     const st = await stat(abs);
+    const safePath = await assertRealInside(abs, cwd);
     if (st.isDirectory()) {
-      const files = await walk(abs);
-      return files.filter(f => /\.ya?ml$/.test(f));
+      const files = await walk(safePath);
+      return files.filter(f => /\.ya?ml$/i.test(f)).sort();
     }
-    return [abs];
+    if (!st.isFile()) return [];
+    return [safePath];
   } catch {
     return discoverWorkflows({ patterns: [input], cwd });
   }

package/src/lib/redact.js

@@ -12,12 +12,25 @@ const TOKEN_PATTERNS = [
   /ghu_[A-Za-z0-9]{30,}/g,
   /github_pat_[A-Za-z0-9_]{30,}/g,
   /xox[abprs]-[A-Za-z0-9-]{10,}/g,
-  /AKIA[0-9A-Z]{16}/g,
+  /(?:AKIA|ASIA)[0-9A-Z]{16}/g,
   /sk-[A-Za-z0-9]{20,}/g,
+  /(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{16,}/g,
+  /AIza[0-9A-Za-z_-]{30,}/g,
+  /ya29\.[0-9A-Za-z_-]{20,}/g,
+  /npm_[0-9A-Za-z]{20,}/g,
+  /eyJ[0-9A-Za-z_-]{8,}\.[0-9A-Za-z_-]{8,}\.[0-9A-Za-z_-]{8,}/g,
   /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,
 ];
 
-const KV_TOKEN_KEYS = /\b(token|secret|password|api[_-]?key|auth[_-]?token|access[_-]?key|private[_-]?key)\s*[:=]\s*["']?([^"'\s,]+)/gi;
+const SENSITIVE_KEY = /(?:token|secret|password|api[_-]?key|auth[_-]?token|access[_-]?key|private[_-]?key)$/i;
+const KV_TOKEN_KEYS = /([\w-]*(?:token|secret|password|api[_-]?key|auth[_-]?token|access[_-]?key|private[_-]?key))(\s*[:=]\s*)["']?([^"'\s,]+)/gi;
+const HIGH_ENTROPY = /[A-Za-z0-9_+/-]{32,}={0,2}/g;
+// This public rule ID is long enough to trip the generic entropy heuristic.
+// Keep the exception exact instead of weakening detection for arbitrary
+// kebab-case values, which may still be credentials or passphrases.
+const SAFE_PUBLIC_VALUES = new Set([
+  'reusable-workflow-secrets-inherit',
+]);
 
 /**
  * Redacts sensitive substrings from a value.
@@ -29,10 +42,58 @@ export function redact(input) {
   if (input == null) return '';
   let s = typeof input === 'string' ? input : String(input);
   for (const re of TOKEN_PATTERNS) s = s.replace(re, '<redacted>');
-  s = s.replace(KV_TOKEN_KEYS, (_, key) => `${key}=<redacted>`);
+  s = s.replace(KV_TOKEN_KEYS, (_, key, separator) => `${key}${separator}<redacted>`);
+  s = s.replace(HIGH_ENTROPY, value => (
+    shouldRedactHighEntropy(value) ? '<redacted>' : value
+  ));
   return s;
 }
 
+/**
+ * Recursively redact strings in a JSON-compatible value.
+ *
+ * @param {unknown} input
+ * @param {WeakSet<object>} [seen]
+ * @returns {unknown}
+ */
+export function redactDeep(input, seen = new WeakSet()) {
+  if (typeof input === 'string') return redact(input);
+  if (input === null || typeof input !== 'object') return input;
+  if (seen.has(input)) return '<circular>';
+  seen.add(input);
+  let output;
+  if (Array.isArray(input)) {
+    output = input.map(item => redactDeep(item, seen));
+  } else {
+    output = {};
+    for (const [key, value] of Object.entries(input)) {
+      output[key] = SENSITIVE_KEY.test(key) ? '<redacted>' : redactDeep(value, seen);
+    }
+  }
+  seen.delete(input);
+  return output;
+}
+
+function shouldRedactHighEntropy(value) {
+  if (SAFE_PUBLIC_VALUES.has(value)) return false;
+  if (/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/i.test(value)) return false;
+  const categories = [
+    /[a-z]/.test(value),
+    /[A-Z]/.test(value),
+    /\d/.test(value),
+    /[_+/=-]/.test(value),
+  ].filter(Boolean).length;
+  if (categories < 2) return false;
+  const frequencies = new Map();
+  for (const char of value) frequencies.set(char, (frequencies.get(char) ?? 0) + 1);
+  let entropy = 0;
+  for (const count of frequencies.values()) {
+    const probability = count / value.length;
+    entropy -= probability * Math.log2(probability);
+  }
+  return entropy >= 3.5;
+}
+
 /**
  * Wraps console.error/log so any string-coerced argument is redacted first.
  *
@@ -40,5 +101,5 @@ export function redact(input) {
  * @returns {(...args: unknown[]) => void}
  */
 export function safeLogger(fn) {
-  return (...args) => fn(...args.map(a => (typeof a === 'string' ? redact(a) : a)));
+  return (...args) => fn(...args.map(a => redactDeep(a)));
 }