codegate-ai 0.10.0 → 0.12.0

package/README.md

@@ -135,10 +135,12 @@ See the [Configuration](#configuration) section for full settings and examples.
 | `--force`               | Skip interactive confirmations.                                                                           |
 | `--include-user-scope`  | Force-enable user/home AI tool config paths for this run (useful if config disables user-scope scanning). |
 | `--collect <mode>`      | Collection scope mode (`default`, `project`, `user`, `explicit`, `all`). Repeatable.                      |
+| `--collect-kind <kind>` | Restrict collection to specific artifact kinds (`workflows`, `actions`, `dependabot`). Repeatable.        |
 | `--strict-collection`   | Treat parse failures in collected inputs as high-severity findings.                                       |
 | `--persona <type>`      | Audit sensitivity (`regular`, `pedantic`, `auditor`).                                                     |
 | `--runtime-mode <mode>` | Runtime mode for optional online audits (`offline`, `online`, `online-no-audits`).                        |
 | `--workflow-audits`     | Enable CI/CD audit pack for GitHub workflow, action, and Dependabot inputs.                               |
+| `--skill <name>`        | Select one skill directory when scanning a skills-index repo URL that contains multiple skills.           |
 | `--reset-state`         | Clear persisted scan-state history and exit.                                                              |
 
 Examples:
@@ -154,7 +156,9 @@ codegate scan . --remediate
 codegate scan . --fix-safe
 codegate scan . --remediate --dry-run --patch
 codegate scan . --workflow-audits --collect project --persona auditor --runtime-mode online
+codegate scan . --workflow-audits --collect project --collect-kind workflows
 codegate scan . --workflow-audits --strict-collection
+codegate scan https://github.com/owner/repo --skill security-review
 codegate scan . --reset-state
 ```
 
@@ -259,12 +263,27 @@ Behavior:
 
 Wrapper flags (consumed by CodeGate, not forwarded):
 
-- `--cg-force`
-- `--cg-deep`
-- `--cg-no-tui`
-- `--cg-include-user-scope`
-- `--cg-format <type>`
-- `--cg-config <path>`
+| Flag                       | Purpose                                                                                   |
+| -------------------------- | ----------------------------------------------------------------------------------------- |
+| `--cg-force`               | Continue install when preflight scan fails or returns blocking findings.                  |
+| `--cg-deep`                | Enable Layer 3 deep analysis during wrapper preflight scan.                               |
+| `--cg-no-tui`              | Disable TUI and interactive prompts for wrapper preflight scan.                           |
+| `--cg-verbose`             | Enable extended terminal output during wrapper preflight scan.                            |
+| `--cg-include-user-scope`  | Include user/home config surfaces in wrapper preflight scan.                              |
+| `--cg-collect <mode>`      | Preflight collection mode (`default`, `project`, `user`, `explicit`, `all`). Repeatable.  |
+| `--cg-collect-kind <kind>` | Preflight collection kind (`workflows`, `actions`, `dependabot`). Repeatable.             |
+| `--cg-strict-collection`   | Treat parse failures in preflight-collected inputs as high-severity findings.             |
+| `--cg-persona <type>`      | Preflight audit persona (`regular`, `pedantic`, `auditor`).                               |
+| `--cg-runtime-mode <mode>` | Preflight runtime mode (`offline`, `online`, `online-no-audits`).                         |
+| `--cg-workflow-audits`     | Enable workflow audit pack for preflight scans.                                           |
+| `--cg-format <type>`       | Set preflight output format: `terminal`, `json`, `sarif`, `markdown`, `html`.             |
+| `--cg-config <path>`       | Use a specific CodeGate config file for wrapper preflight scan.                           |
+| `--`                       | Stop wrapper-option parsing and pass all following args to the wrapped installer command. |
+
+Inspect command help for complete usage:
+
+- `codegate skills --help`
+- `codegate clawhub --help`
 
 Examples:
 
@@ -272,9 +291,23 @@ Examples:
 codegate skills add https://github.com/vercel-labs/skills --skill find-skills
 codegate skills add https://github.com/owner/repo --skill security-review --cg-force
 codegate skills add https://github.com/owner/repo --skill security-review --cg-deep
+codegate skills add https://github.com/owner/repo --skill security-review --cg-workflow-audits --cg-collect project
+codegate skills add https://github.com/owner/repo --skill security-review --cg-collect-kind workflows
+codegate skills add https://github.com/owner/repo --skill security-review --cg-strict-collection --cg-persona auditor
+codegate skills add https://github.com/owner/repo --skill security-review --cg-runtime-mode online
+codegate skills add https://github.com/owner/repo --skill security-review --cg-format json
+codegate skills add https://github.com/owner/repo --skill security-review --cg-config ~/.codegate/config.json
+codegate skills add https://github.com/owner/repo --skill security-review -- --registry custom
 codegate clawhub install security-auditor
 codegate clawhub install security-auditor --version 1.0.0
 codegate clawhub install security-auditor --cg-deep
+codegate clawhub install security-auditor --cg-workflow-audits --cg-collect project
+codegate clawhub install security-auditor --cg-collect-kind workflows
+codegate clawhub install security-auditor --cg-strict-collection --cg-persona auditor
+codegate clawhub install security-auditor --cg-runtime-mode online
+codegate clawhub install security-auditor --cg-no-tui --cg-format json
+codegate clawhub install security-auditor --cg-config ~/.codegate/config.json
+codegate clawhub install security-auditor -- --registry https://registry.clawhub.ai
 codegate clawhub search security
 ```
 

package/dist/cli.js

@@ -31,6 +31,26 @@ function isNoTuiEnabled(options) {
 function renderExampleHelp(lines) {
     return ["", "Examples:", ...lines.map((line) => `  ${line}`)].join("\n");
 }
+function renderWrapperOptionsHelp() {
+    return [
+        "",
+        "CodeGate wrapper options (consumed by CodeGate, not forwarded to the wrapped CLI):",
+        "  --cg-force               continue install when preflight is warning/error",
+        "  --cg-deep                enable Layer 3 deep analysis during preflight",
+        "  --cg-no-tui              disable TUI and interactive prompts for preflight",
+        "  --cg-verbose             show extended terminal output during preflight",
+        "  --cg-include-user-scope  include user/home config paths in preflight scan",
+        "  --cg-collect <mode>      preflight collection mode (repeatable): default|project|user|explicit|all",
+        "  --cg-collect-kind <kind> preflight collection kind (repeatable): workflows|actions|dependabot",
+        "  --cg-strict-collection   treat preflight parse failures as high severity",
+        "  --cg-persona <type>      preflight audit sensitivity: regular|pedantic|auditor",
+        "  --cg-runtime-mode <mode> preflight runtime mode: offline|online|online-no-audits",
+        "  --cg-workflow-audits     enable workflow audit pack during preflight",
+        "  --cg-format <type>       preflight report format: terminal|json|sarif|markdown|html",
+        "  --cg-config <path>       use a specific CodeGate config file for preflight",
+        "  --                        pass subsequent args through to wrapped CLI unchanged",
+    ].join("\n");
+}
 export function isDirectCliInvocation(importMetaUrl, argv1, deps = {}) {
     if (!argv1) {
         return false;
@@ -460,9 +480,11 @@ function addSkillsCommand(program, version, deps) {
         .description("Wrap npx skills with CodeGate preflight scanning for installs")
         .allowUnknownOption(true)
         .allowExcessArguments(true)
+        .addHelpText("after", renderWrapperOptionsHelp())
         .addHelpText("after", renderExampleHelp([
         "codegate skills add vercel-labs/skills --skill find-skills",
         "codegate skills add https://github.com/owner/repo --skill security-review",
+        "codegate skills add owner/repo --skill demo --cg-workflow-audits --cg-collect project",
         "codegate skills add owner/repo --skill demo --cg-deep",
         "codegate skills find security",
         "codegate skills add owner/repo --skill demo --cg-force",
@@ -504,9 +526,11 @@ function addClawhubCommand(program, version, deps) {
         .description("Wrap npx clawhub with CodeGate preflight scanning for installs")
         .allowUnknownOption(true)
         .allowExcessArguments(true)
+        .addHelpText("after", renderWrapperOptionsHelp())
         .addHelpText("after", renderExampleHelp([
         "codegate clawhub install security-auditor",
         "codegate clawhub install security-auditor --version 1.0.0",
+        "codegate clawhub install security-auditor --cg-workflow-audits --cg-collect project",
         "codegate clawhub install security-auditor --cg-deep",
         "codegate clawhub search security",
         "codegate clawhub install security-auditor --cg-force",

package/dist/commands/clawhub-wrapper.d.ts

@@ -1,4 +1,4 @@
-import { type CodeGateConfig, type OutputFormat, type ResolveConfigOptions } from "../config.js";
+import { type AuditPersona, type CodeGateConfig, type OutputFormat, type ResolveConfigOptions, type RuntimeMode, type ScanCollectionKind, type ScanCollectionMode } from "../config.js";
 import { type ResolvedScanTarget } from "../scan-target.js";
 import type { CodeGateReport } from "../types/report.js";
 import { type ScanAnalysisDeps, type ScanRunnerInput } from "./scan-command.js";
@@ -10,7 +10,14 @@ export interface ClawhubWrapperRuntimeOptions {
     force: boolean;
     deep: boolean;
     noTui: boolean;
+    verbose: boolean;
     includeUserScope: boolean;
+    strictCollection: boolean;
+    workflowAudits: boolean;
+    collect: ScanCollectionMode[];
+    collectKinds: ScanCollectionKind[];
+    persona?: AuditPersona;
+    runtimeMode?: RuntimeMode;
     format?: OutputFormat;
     configPath?: string;
 }

package/dist/commands/clawhub-wrapper.js

@@ -3,7 +3,7 @@ import { existsSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:
 import { tmpdir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { createInterface } from "node:readline/promises";
-import { OUTPUT_FORMATS, } from "../config.js";
+import { PERSONAS, RUNTIME_MODES, SCAN_COLLECTION_KINDS, SCAN_COLLECTION_MODES, OUTPUT_FORMATS, } from "../config.js";
 import { resolveScanTarget } from "../scan-target.js";
 import { runScanAnalysis } from "./scan-command.js";
 import { renderByFormat, summarizeRequestedTargetFindings } from "./scan-command/helpers.js";
@@ -40,6 +40,38 @@ function parseOutputFormat(value) {
     }
     return matched;
 }
+function parseCollectionMode(value) {
+    const normalized = value.trim().toLowerCase();
+    const matched = SCAN_COLLECTION_MODES.find((mode) => mode === normalized);
+    if (!matched) {
+        throw new Error(`Unsupported --cg-collect value "${value}". Valid values: ${SCAN_COLLECTION_MODES.join(", ")}.`);
+    }
+    return matched;
+}
+function parseCollectionKind(value) {
+    const normalized = value.trim().toLowerCase();
+    const matched = SCAN_COLLECTION_KINDS.find((kind) => kind === normalized);
+    if (!matched) {
+        throw new Error(`Unsupported --cg-collect-kind value "${value}". Valid values: ${SCAN_COLLECTION_KINDS.join(", ")}.`);
+    }
+    return matched;
+}
+function parsePersona(value) {
+    const normalized = value.trim().toLowerCase();
+    const matched = PERSONAS.find((persona) => persona === normalized);
+    if (!matched) {
+        throw new Error(`Unsupported --cg-persona value "${value}". Valid values: ${PERSONAS.join(", ")}.`);
+    }
+    return matched;
+}
+function parseRuntimeMode(value) {
+    const normalized = value.trim().toLowerCase();
+    const matched = RUNTIME_MODES.find((mode) => mode === normalized);
+    if (!matched) {
+        throw new Error(`Unsupported --cg-runtime-mode value "${value}". Valid values: ${RUNTIME_MODES.join(", ")}.`);
+    }
+    return matched;
+}
 function isLikelyHttpUrl(value) {
     return /^https?:\/\//iu.test(value);
 }
@@ -383,7 +415,14 @@ export function parseClawhubInvocation(rawArgs, context) {
         force: false,
         deep: false,
         noTui: false,
+        verbose: false,
         includeUserScope: false,
+        strictCollection: false,
+        workflowAudits: false,
+        collect: [],
+        collectKinds: [],
+        persona: undefined,
+        runtimeMode: undefined,
         format: undefined,
         configPath: undefined,
     };
@@ -409,10 +448,22 @@ export function parseClawhubInvocation(rawArgs, context) {
             wrapper.noTui = true;
             continue;
         }
+        if (token === "--cg-verbose") {
+            wrapper.verbose = true;
+            continue;
+        }
         if (token === "--cg-include-user-scope") {
             wrapper.includeUserScope = true;
             continue;
         }
+        if (token === "--cg-strict-collection") {
+            wrapper.strictCollection = true;
+            continue;
+        }
+        if (token === "--cg-workflow-audits") {
+            wrapper.workflowAudits = true;
+            continue;
+        }
         if (token === "--cg-format" || token.startsWith("--cg-format=")) {
             const [value, consumedIndex] = parseWrapperOptionValue(rawArgs, index, "--cg-format");
             wrapper.format = parseOutputFormat(value);
@@ -425,6 +476,36 @@ export function parseClawhubInvocation(rawArgs, context) {
             index = consumedIndex;
             continue;
         }
+        if (token === "--cg-collect" || token.startsWith("--cg-collect=")) {
+            const [value, consumedIndex] = parseWrapperOptionValue(rawArgs, index, "--cg-collect");
+            const mode = parseCollectionMode(value);
+            if (!wrapper.collect.includes(mode)) {
+                wrapper.collect.push(mode);
+            }
+            index = consumedIndex;
+            continue;
+        }
+        if (token === "--cg-collect-kind" || token.startsWith("--cg-collect-kind=")) {
+            const [value, consumedIndex] = parseWrapperOptionValue(rawArgs, index, "--cg-collect-kind");
+            const kind = parseCollectionKind(value);
+            if (!wrapper.collectKinds.includes(kind)) {
+                wrapper.collectKinds.push(kind);
+            }
+            index = consumedIndex;
+            continue;
+        }
+        if (token === "--cg-persona" || token.startsWith("--cg-persona=")) {
+            const [value, consumedIndex] = parseWrapperOptionValue(rawArgs, index, "--cg-persona");
+            wrapper.persona = parsePersona(value);
+            index = consumedIndex;
+            continue;
+        }
+        if (token === "--cg-runtime-mode" || token.startsWith("--cg-runtime-mode=")) {
+            const [value, consumedIndex] = parseWrapperOptionValue(rawArgs, index, "--cg-runtime-mode");
+            wrapper.runtimeMode = parseRuntimeMode(value);
+            index = consumedIndex;
+            continue;
+        }
         if (token.startsWith("--cg-")) {
             throw new Error(`Unknown CodeGate wrapper option: ${token}`);
         }
@@ -529,9 +610,24 @@ export async function executeClawhubWrapper(input, deps) {
             scanTarget: resolvedTarget.scanTarget,
             cli: cliConfig,
         });
-        const config = parsed.wrapper.includeUserScope
-            ? { ...baseConfig, scan_user_scope: true }
-            : baseConfig;
+        const config = {
+            ...baseConfig,
+            scan_user_scope: parsed.wrapper.includeUserScope === true ? true : (baseConfig.scan_user_scope ?? false),
+            scan_collection_modes: parsed.wrapper.collect.length > 0
+                ? parsed.wrapper.collect
+                : baseConfig.scan_collection_modes,
+            scan_collection_kinds: parsed.wrapper.collectKinds.length > 0
+                ? parsed.wrapper.collectKinds
+                : baseConfig.scan_collection_kinds,
+            strict_collection: parsed.wrapper.strictCollection === true ? true : (baseConfig.strict_collection ?? false),
+            persona: parsed.wrapper.persona ?? baseConfig.persona,
+            runtime_mode: parsed.wrapper.runtimeMode ?? baseConfig.runtime_mode,
+            workflow_audits: {
+                enabled: parsed.wrapper.workflowAudits === true
+                    ? true
+                    : (baseConfig.workflow_audits?.enabled ?? false),
+            },
+        };
         const { report, deepScanNotes } = await runScanAnalysis({
             version: input.version,
             scanTarget: resolvedTarget.scanTarget,
@@ -541,8 +637,14 @@ export async function executeClawhubWrapper(input, deps) {
             options: {
                 noTui,
                 format: parsed.wrapper.format,
+                verbose: parsed.wrapper.verbose,
                 force: parsed.wrapper.force,
                 includeUserScope: parsed.wrapper.includeUserScope,
+                collect: parsed.wrapper.collect.length > 0 ? parsed.wrapper.collect : undefined,
+                strictCollection: parsed.wrapper.strictCollection,
+                persona: parsed.wrapper.persona,
+                runtimeMode: parsed.wrapper.runtimeMode,
+                workflowAudits: parsed.wrapper.workflowAudits,
                 deep: parsed.wrapper.deep,
             },
         }, {

package/dist/commands/skills-wrapper.d.ts

@@ -1,4 +1,4 @@
-import { type CodeGateConfig, type OutputFormat, type ResolveConfigOptions } from "../config.js";
+import { type AuditPersona, type CodeGateConfig, type OutputFormat, type ResolveConfigOptions, type RuntimeMode, type ScanCollectionKind, type ScanCollectionMode } from "../config.js";
 import { type ResolvedScanTarget } from "../scan-target.js";
 import { type ScanAnalysisDeps, type ScanRunnerInput } from "./scan-command.js";
 import type { CodeGateReport } from "../types/report.js";
@@ -6,7 +6,14 @@ export interface SkillsWrapperRuntimeOptions {
     force: boolean;
     deep: boolean;
     noTui: boolean;
+    verbose: boolean;
     includeUserScope: boolean;
+    strictCollection: boolean;
+    workflowAudits: boolean;
+    collect: ScanCollectionMode[];
+    collectKinds: ScanCollectionKind[];
+    persona?: AuditPersona;
+    runtimeMode?: RuntimeMode;
     format?: OutputFormat;
     configPath?: string;
 }

package/dist/commands/skills-wrapper.js

@@ -2,7 +2,7 @@ import { spawnSync } from "node:child_process";
 import { existsSync } from "node:fs";
 import { createInterface } from "node:readline/promises";
 import { resolve } from "node:path";
-import { OUTPUT_FORMATS, } from "../config.js";
+import { PERSONAS, RUNTIME_MODES, SCAN_COLLECTION_KINDS, SCAN_COLLECTION_MODES, OUTPUT_FORMATS, } from "../config.js";
 import { renderByFormat, summarizeRequestedTargetFindings } from "./scan-command/helpers.js";
 import { resolveScanTarget } from "../scan-target.js";
 import { runScanAnalysis } from "./scan-command.js";
@@ -33,6 +33,38 @@ function parseOutputFormat(value) {
     }
     return matched;
 }
+function parseCollectionMode(value) {
+    const normalized = value.trim().toLowerCase();
+    const matched = SCAN_COLLECTION_MODES.find((mode) => mode === normalized);
+    if (!matched) {
+        throw new Error(`Unsupported --cg-collect value "${value}". Valid values: ${SCAN_COLLECTION_MODES.join(", ")}.`);
+    }
+    return matched;
+}
+function parseCollectionKind(value) {
+    const normalized = value.trim().toLowerCase();
+    const matched = SCAN_COLLECTION_KINDS.find((kind) => kind === normalized);
+    if (!matched) {
+        throw new Error(`Unsupported --cg-collect-kind value "${value}". Valid values: ${SCAN_COLLECTION_KINDS.join(", ")}.`);
+    }
+    return matched;
+}
+function parsePersona(value) {
+    const normalized = value.trim().toLowerCase();
+    const matched = PERSONAS.find((persona) => persona === normalized);
+    if (!matched) {
+        throw new Error(`Unsupported --cg-persona value "${value}". Valid values: ${PERSONAS.join(", ")}.`);
+    }
+    return matched;
+}
+function parseRuntimeMode(value) {
+    const normalized = value.trim().toLowerCase();
+    const matched = RUNTIME_MODES.find((mode) => mode === normalized);
+    if (!matched) {
+        throw new Error(`Unsupported --cg-runtime-mode value "${value}". Valid values: ${RUNTIME_MODES.join(", ")}.`);
+    }
+    return matched;
+}
 function isLikelyGitSshSource(value) {
     return /^git@[^:]+:.+/iu.test(value) || /^ssh:\/\//iu.test(value);
 }
@@ -179,7 +211,14 @@ export function parseSkillsInvocation(rawArgs, context) {
         force: false,
         deep: false,
         noTui: false,
+        verbose: false,
         includeUserScope: false,
+        strictCollection: false,
+        workflowAudits: false,
+        collect: [],
+        collectKinds: [],
+        persona: undefined,
+        runtimeMode: undefined,
         format: undefined,
         configPath: undefined,
     };
@@ -205,10 +244,22 @@ export function parseSkillsInvocation(rawArgs, context) {
             wrapper.noTui = true;
             continue;
         }
+        if (token === "--cg-verbose") {
+            wrapper.verbose = true;
+            continue;
+        }
         if (token === "--cg-include-user-scope") {
             wrapper.includeUserScope = true;
             continue;
         }
+        if (token === "--cg-strict-collection") {
+            wrapper.strictCollection = true;
+            continue;
+        }
+        if (token === "--cg-workflow-audits") {
+            wrapper.workflowAudits = true;
+            continue;
+        }
         if (token === "--cg-format" || token.startsWith("--cg-format=")) {
             const [value, consumedIndex] = parseWrapperOptionValue(rawArgs, index, "--cg-format");
             wrapper.format = parseOutputFormat(value);
@@ -221,6 +272,36 @@ export function parseSkillsInvocation(rawArgs, context) {
             index = consumedIndex;
             continue;
         }
+        if (token === "--cg-collect" || token.startsWith("--cg-collect=")) {
+            const [value, consumedIndex] = parseWrapperOptionValue(rawArgs, index, "--cg-collect");
+            const mode = parseCollectionMode(value);
+            if (!wrapper.collect.includes(mode)) {
+                wrapper.collect.push(mode);
+            }
+            index = consumedIndex;
+            continue;
+        }
+        if (token === "--cg-collect-kind" || token.startsWith("--cg-collect-kind=")) {
+            const [value, consumedIndex] = parseWrapperOptionValue(rawArgs, index, "--cg-collect-kind");
+            const kind = parseCollectionKind(value);
+            if (!wrapper.collectKinds.includes(kind)) {
+                wrapper.collectKinds.push(kind);
+            }
+            index = consumedIndex;
+            continue;
+        }
+        if (token === "--cg-persona" || token.startsWith("--cg-persona=")) {
+            const [value, consumedIndex] = parseWrapperOptionValue(rawArgs, index, "--cg-persona");
+            wrapper.persona = parsePersona(value);
+            index = consumedIndex;
+            continue;
+        }
+        if (token === "--cg-runtime-mode" || token.startsWith("--cg-runtime-mode=")) {
+            const [value, consumedIndex] = parseWrapperOptionValue(rawArgs, index, "--cg-runtime-mode");
+            wrapper.runtimeMode = parseRuntimeMode(value);
+            index = consumedIndex;
+            continue;
+        }
         if (token.startsWith("--cg-")) {
             throw new Error(`Unknown CodeGate wrapper option: ${token}`);
         }
@@ -322,9 +403,24 @@ export async function executeSkillsWrapper(input, deps) {
             scanTarget: resolvedTarget.scanTarget,
             cli: cliConfig,
         });
-        const config = parsed.wrapper.includeUserScope
-            ? { ...baseConfig, scan_user_scope: true }
-            : baseConfig;
+        const config = {
+            ...baseConfig,
+            scan_user_scope: parsed.wrapper.includeUserScope === true ? true : (baseConfig.scan_user_scope ?? false),
+            scan_collection_modes: parsed.wrapper.collect.length > 0
+                ? parsed.wrapper.collect
+                : baseConfig.scan_collection_modes,
+            scan_collection_kinds: parsed.wrapper.collectKinds.length > 0
+                ? parsed.wrapper.collectKinds
+                : baseConfig.scan_collection_kinds,
+            strict_collection: parsed.wrapper.strictCollection === true ? true : (baseConfig.strict_collection ?? false),
+            persona: parsed.wrapper.persona ?? baseConfig.persona,
+            runtime_mode: parsed.wrapper.runtimeMode ?? baseConfig.runtime_mode,
+            workflow_audits: {
+                enabled: parsed.wrapper.workflowAudits === true
+                    ? true
+                    : (baseConfig.workflow_audits?.enabled ?? false),
+            },
+        };
         const { report, deepScanNotes } = await runScanAnalysis({
             version: input.version,
             scanTarget: resolvedTarget.scanTarget,
@@ -334,8 +430,14 @@ export async function executeSkillsWrapper(input, deps) {
             options: {
                 noTui,
                 format: parsed.wrapper.format,
+                verbose: parsed.wrapper.verbose,
                 force: parsed.wrapper.force,
                 includeUserScope: parsed.wrapper.includeUserScope,
+                collect: parsed.wrapper.collect.length > 0 ? parsed.wrapper.collect : undefined,
+                strictCollection: parsed.wrapper.strictCollection,
+                persona: parsed.wrapper.persona,
+                runtimeMode: parsed.wrapper.runtimeMode,
+                workflowAudits: parsed.wrapper.workflowAudits,
                 skill: preferredSkill,
                 deep: parsed.wrapper.deep,
             },

package/dist/layer2-static/advisories/gha-known-vulnerable-actions.json

@@ -1,4 +1,6 @@
 {
   "actions/checkout": ["v3"],
-  "tj-actions/changed-files": ["v39"]
+  "tj-actions/changed-files": ["v39"],
+  "aquasecurity/trivy-action": ["<0.35.0"],
+  "aquasecurity/setup-trivy": [">=0.1.0 <0.2.7"]
 }

package/dist/layer2-static/detectors/workflow-floating-action-version.d.ts

@@ -0,0 +1,7 @@
+import type { Finding } from "../../types/finding.js";
+export interface WorkflowFloatingActionVersionInput {
+    filePath: string;
+    parsed: unknown;
+    textContent: string;
+}
+export declare function detectWorkflowFloatingActionVersion(input: WorkflowFloatingActionVersionInput): Finding[];

package/dist/layer2-static/detectors/workflow-floating-action-version.js

@@ -0,0 +1,63 @@
+import { buildFindingEvidence } from "../evidence.js";
+import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
+const FLOATING_VERSION_VALUES = new Set(["latest", "stable", "edge", "nightly", "main", "master"]);
+const VERSION_KEY_PATTERN = /version/iu;
+function isRepositoryUses(value) {
+    if (typeof value !== "string") {
+        return false;
+    }
+    return /^[a-z0-9._-]+\/[a-z0-9._-]+(?:\/[^@]+)?@[^\s]+$/iu.test(value.trim());
+}
+function isFloatingVersionValue(value) {
+    const normalized = value.trim().toLowerCase();
+    return FLOATING_VERSION_VALUES.has(normalized);
+}
+export function detectWorkflowFloatingActionVersion(input) {
+    if (!isGitHubWorkflowPath(input.filePath)) {
+        return [];
+    }
+    const facts = extractWorkflowFacts(input.parsed);
+    if (!facts) {
+        return [];
+    }
+    const findings = [];
+    facts.jobs.forEach((job, jobIndex) => {
+        job.steps.forEach((step, stepIndex) => {
+            if (!isRepositoryUses(step.uses) || !step.with) {
+                return;
+            }
+            for (const [withKey, withValue] of Object.entries(step.with)) {
+                if (!VERSION_KEY_PATTERN.test(withKey) || !isFloatingVersionValue(withValue)) {
+                    continue;
+                }
+                const evidence = buildFindingEvidence({
+                    textContent: input.textContent,
+                    searchTerms: [step.uses ?? "", withKey, withValue],
+                    fallbackValue: `${withKey}: ${withValue}`,
+                });
+                findings.push({
+                    rule_id: "workflow-floating-action-version",
+                    finding_id: `WORKFLOW_FLOATING_ACTION_VERSION-${input.filePath}-${jobIndex}-${stepIndex}-${withKey}`,
+                    severity: "MEDIUM",
+                    category: "CI_SUPPLY_CHAIN",
+                    layer: "L2",
+                    file_path: input.filePath,
+                    location: { field: `jobs.${job.id}.steps[${stepIndex}].with.${withKey}` },
+                    description: "Action input uses a floating version selector, which can pull unexpected releases over time",
+                    affected_tools: ["github-actions"],
+                    cve: null,
+                    owasp: ["ASI02"],
+                    cwe: "CWE-1104",
+                    confidence: "HIGH",
+                    fixable: false,
+                    remediation_actions: [
+                        "Pin action input versions to explicit releases instead of mutable selectors like latest",
+                    ],
+                    evidence: evidence?.evidence ?? null,
+                    suppressed: false,
+                });
+            }
+        });
+    });
+    return findings;
+}

package/dist/layer2-static/detectors/workflow-forbidden-uses.js

@@ -104,6 +104,39 @@ export function detectWorkflowForbiddenUses(input) {
     }
     const findings = [];
     facts.jobs.forEach((job, jobIndex) => {
+        const jobUses = job.uses?.trim();
+        if (jobUses && isForbidden(jobUses, policy)) {
+            const evidence = buildFindingEvidence({
+                textContent: input.textContent,
+                searchTerms: [jobUses],
+                fallbackValue: `uses: ${jobUses}`,
+            });
+            findings.push({
+                rule_id: "workflow-forbidden-uses",
+                finding_id: `WORKFLOW_FORBIDDEN_USES-JOB-${input.filePath}-${jobIndex}`,
+                severity: "HIGH",
+                category: "CI_SUPPLY_CHAIN",
+                layer: "L2",
+                file_path: input.filePath,
+                location: { field: `jobs.${job.id}.uses` },
+                description: policy.mode === "allow"
+                    ? "Workflow uses repository action outside the configured allowlist"
+                    : "Workflow uses repository action matching the configured denylist",
+                affected_tools: ["github-actions"],
+                cve: null,
+                owasp: ["ASI02"],
+                cwe: "CWE-829",
+                confidence: "HIGH",
+                fixable: false,
+                remediation_actions: [
+                    policy.mode === "allow"
+                        ? "Add the action to the allowlist only if it is explicitly trusted"
+                        : "Remove the action or move it to an allowlist-only policy if it is trusted",
+                ],
+                evidence: evidence?.evidence ?? null,
+                suppressed: false,
+            });
+        }
         job.steps.forEach((step, stepIndex) => {
             const uses = step.uses?.trim();
             if (!uses) {