codegate-ai 0.10.0 → 0.12.0

package/dist/layer2-static/detectors/workflow-github-env.js

@@ -1,7 +1,60 @@
 import { buildFindingEvidence } from "../evidence.js";
 import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
-function writesToGithubEnv(run) {
-    return typeof run === "string" && />>\s*["']?\$?\{?GITHUB_ENV\}?/iu.test(run);
+const UNTRUSTED_TRIGGERS = new Set([
+    "pull_request",
+    "pull_request_target",
+    "issue_comment",
+    "discussion_comment",
+    "pull_request_review_comment",
+    "workflow_run",
+]);
+const UNTRUSTED_EVENT_REFERENCE_PATTERNS = [
+    /\bgithub\.event\.pull_request\.(?:title|body|head\.ref|head\.label|head\.repo\.full_name)\b/iu,
+    /\bgithub\.event\.issue\.(?:title|body)\b/iu,
+    /\bgithub\.event\.comment\.body\b/iu,
+    /\bgithub\.event\.review\.body\b/iu,
+    /\bgithub\.event\.discussion\.body\b/iu,
+    /\bgithub\.head_ref\b/iu,
+];
+const COMMAND_FILE_SPECS = [
+    {
+        name: "GITHUB_ENV",
+        severity: "HIGH",
+        writePatterns: [/>>\s*["']?\$?\{?GITHUB_ENV\}?/iu, /\btee\s+-a\s+["']?\$?\{?GITHUB_ENV\}?/iu],
+    },
+    {
+        name: "GITHUB_PATH",
+        severity: "CRITICAL",
+        writePatterns: [/>>\s*["']?\$?\{?GITHUB_PATH\}?/iu, /\btee\s+-a\s+["']?\$?\{?GITHUB_PATH\}?/iu],
+    },
+    {
+        name: "GITHUB_OUTPUT",
+        severity: "HIGH",
+        writePatterns: [
+            />>\s*["']?\$?\{?GITHUB_OUTPUT\}?/iu,
+            /\btee\s+-a\s+["']?\$?\{?GITHUB_OUTPUT\}?/iu,
+        ],
+    },
+    {
+        name: "GITHUB_STATE",
+        severity: "MEDIUM",
+        writePatterns: [
+            />>\s*["']?\$?\{?GITHUB_STATE\}?/iu,
+            /\btee\s+-a\s+["']?\$?\{?GITHUB_STATE\}?/iu,
+        ],
+    },
+];
+function hasUntrustedEventReference(value) {
+    if (typeof value !== "string") {
+        return false;
+    }
+    return UNTRUSTED_EVENT_REFERENCE_PATTERNS.some((pattern) => pattern.test(value));
+}
+function collectWrittenCommandFiles(run) {
+    if (typeof run !== "string") {
+        return [];
+    }
+    return COMMAND_FILE_SPECS.filter((spec) => spec.writePatterns.some((pattern) => pattern.test(run)));
 }
 export function detectWorkflowGithubEnv(input) {
     if (!isGitHubWorkflowPath(input.filePath)) {
@@ -12,36 +65,44 @@ export function detectWorkflowGithubEnv(input) {
         return [];
     }
     const findings = [];
+    const hasUntrustedTrigger = facts.triggers.some((trigger) => UNTRUSTED_TRIGGERS.has(trigger));
     facts.jobs.forEach((job, jobIndex) => {
         job.steps.forEach((step, stepIndex) => {
-            if (!writesToGithubEnv(step.run)) {
+            const writtenCommandFiles = collectWrittenCommandFiles(step.run);
+            if (writtenCommandFiles.length === 0) {
                 return;
             }
-            const evidence = buildFindingEvidence({
-                textContent: input.textContent,
-                searchTerms: [step.run ?? "", "GITHUB_ENV"],
-                fallbackValue: step.run ?? "write to GITHUB_ENV",
-            });
-            findings.push({
-                rule_id: "workflow-github-env",
-                finding_id: `WORKFLOW_GITHUB_ENV-${input.filePath}-${jobIndex}-${stepIndex}`,
-                severity: "HIGH",
-                category: "CI_SUPPLY_CHAIN",
-                layer: "L2",
-                file_path: input.filePath,
-                location: { field: `jobs.${job.id}.steps[${stepIndex}].run` },
-                description: "Run step writes to GITHUB_ENV",
-                affected_tools: ["github-actions"],
-                cve: null,
-                owasp: ["ASI02"],
-                cwe: "CWE-94",
-                confidence: "HIGH",
-                fixable: false,
-                remediation_actions: [
-                    "Avoid writing attacker-controlled values to GITHUB_ENV and prefer validated environment variables",
-                ],
-                evidence: evidence?.evidence ?? null,
-                suppressed: false,
+            if (!hasUntrustedTrigger && !hasUntrustedEventReference(step.run)) {
+                return;
+            }
+            writtenCommandFiles.forEach((commandFile) => {
+                const evidence = buildFindingEvidence({
+                    textContent: input.textContent,
+                    searchTerms: [step.run ?? "", commandFile.name],
+                    fallbackValue: step.run ?? `write to ${commandFile.name}`,
+                });
+                findings.push({
+                    rule_id: "workflow-command-file-poisoning",
+                    finding_id: `WORKFLOW_COMMAND_FILE_POISONING-${commandFile.name}-${input.filePath}-${jobIndex}-${stepIndex}`,
+                    severity: commandFile.severity,
+                    category: "CI_TEMPLATE_INJECTION",
+                    layer: "L2",
+                    file_path: input.filePath,
+                    location: { field: `jobs.${job.id}.steps[${stepIndex}].run` },
+                    description: `Run step writes to ${commandFile.name} in an untrusted workflow context`,
+                    affected_tools: ["github-actions"],
+                    cve: null,
+                    owasp: ["ASI02"],
+                    cwe: "CWE-94",
+                    confidence: "HIGH",
+                    fixable: false,
+                    remediation_actions: [
+                        "Avoid writing attacker-controlled values into GitHub command files",
+                        "Use strict allow-lists and sanitization before propagating untrusted data between workflow steps",
+                    ],
+                    evidence: evidence?.evidence ?? null,
+                    suppressed: false,
+                });
             });
         });
     });

package/dist/layer2-static/detectors/workflow-known-vuln-action.js

@@ -16,6 +16,74 @@ function parseRepositoryUses(value) {
     }
     return { slug, ref };
 }
+function parseSemverLike(value) {
+    const match = value.trim().match(/^v?(\d+)(?:\.(\d+))?(?:\.(\d+))?(?:[-+].*)?$/iu);
+    if (!match?.[1]) {
+        return null;
+    }
+    return [
+        Number.parseInt(match[1], 10),
+        Number.parseInt(match[2] ?? "0", 10),
+        Number.parseInt(match[3] ?? "0", 10),
+    ];
+}
+function compareSemverLike(left, right) {
+    for (let index = 0; index < 3; index += 1) {
+        if (left[index] < right[index]) {
+            return -1;
+        }
+        if (left[index] > right[index]) {
+            return 1;
+        }
+    }
+    return 0;
+}
+function matchesComparator(ref, comparator) {
+    const match = comparator.trim().match(/^(<=|>=|<|>|=)\s*(v?\d+(?:\.\d+){0,2})$/iu);
+    if (!match?.[1] || !match[2]) {
+        return false;
+    }
+    const refVersion = parseSemverLike(ref);
+    const comparatorVersion = parseSemverLike(match[2]);
+    if (!refVersion || !comparatorVersion) {
+        return false;
+    }
+    const comparison = compareSemverLike(refVersion, comparatorVersion);
+    switch (match[1]) {
+        case "<":
+            return comparison < 0;
+        case "<=":
+            return comparison <= 0;
+        case ">":
+            return comparison > 0;
+        case ">=":
+            return comparison >= 0;
+        case "=":
+            return comparison === 0;
+        default:
+            return false;
+    }
+}
+function matchesVulnerablePattern(ref, pattern) {
+    const normalizedRef = ref.trim().toLowerCase();
+    const normalizedPattern = pattern.trim().toLowerCase();
+    if (normalizedPattern.length === 0) {
+        return false;
+    }
+    if (normalizedPattern.includes("*")) {
+        return normalizedPattern.endsWith("*")
+            ? normalizedRef.startsWith(normalizedPattern.slice(0, -1))
+            : normalizedRef === normalizedPattern;
+    }
+    if (/^(?:<=|>=|<|>|=)/u.test(normalizedPattern)) {
+        const comparators = normalizedPattern.split(/\s+/u).filter((token) => token.length > 0);
+        return comparators.every((comparator) => matchesComparator(normalizedRef, comparator));
+    }
+    return normalizedRef === normalizedPattern;
+}
+function isKnownVulnerableRef(ref, patterns) {
+    return patterns.some((pattern) => matchesVulnerablePattern(ref, pattern));
+}
 export function detectWorkflowKnownVulnAction(input) {
     if (input.runtimeMode !== "online") {
         return [];
@@ -30,6 +98,36 @@ export function detectWorkflowKnownVulnAction(input) {
     const advisories = loadKnownVulnerableActions({ runtimeMode: input.runtimeMode }).advisories;
     const findings = [];
     facts.jobs.forEach((job, jobIndex) => {
+        const jobUses = job.uses;
+        if (jobUses) {
+            const parsedJobUses = parseRepositoryUses(jobUses);
+            if (parsedJobUses) {
+                const vulnerableVersions = advisories[parsedJobUses.slug];
+                if (vulnerableVersions && isKnownVulnerableRef(parsedJobUses.ref, vulnerableVersions)) {
+                    findings.push({
+                        rule_id: "workflow-known-vuln-action",
+                        finding_id: `WORKFLOW_KNOWN_VULN_ACTION-JOB-${input.filePath}-${jobIndex}`,
+                        severity: "HIGH",
+                        category: "CI_VULNERABLE_ACTION",
+                        layer: "L2",
+                        file_path: input.filePath,
+                        location: { field: `jobs.${job.id}.uses` },
+                        description: `Action ${parsedJobUses.slug}@${parsedJobUses.ref} is listed in known vulnerable references`,
+                        affected_tools: ["github-actions"],
+                        cve: null,
+                        owasp: ["ASI02"],
+                        cwe: "CWE-937",
+                        confidence: "HIGH",
+                        fixable: false,
+                        remediation_actions: [
+                            "Upgrade to a non-vulnerable action release and pin to a reviewed commit SHA",
+                        ],
+                        evidence: jobUses,
+                        suppressed: false,
+                    });
+                }
+            }
+        }
         job.steps.forEach((step, stepIndex) => {
             const uses = step.uses;
             if (!uses) {
@@ -40,7 +138,7 @@ export function detectWorkflowKnownVulnAction(input) {
                 return;
             }
             const vulnerableVersions = advisories[parsedUses.slug];
-            if (!vulnerableVersions || !vulnerableVersions.includes(parsedUses.ref)) {
+            if (!vulnerableVersions || !isKnownVulnerableRef(parsedUses.ref, vulnerableVersions)) {
                 return;
             }
             findings.push({

package/dist/layer2-static/detectors/workflow-ref-confusion.js

@@ -30,6 +30,36 @@ export function detectWorkflowRefConfusion(input) {
     }
     const findings = [];
     for (const [jobIndex, job] of facts.jobs.entries()) {
+        const jobUses = job.uses?.trim();
+        if (jobUses) {
+            const parsedJobUses = parseRepositoryUses(jobUses);
+            if (parsedJobUses && !isHashPinned(parsedJobUses.ref)) {
+                const evidence = buildFindingEvidence({
+                    textContent: input.textContent,
+                    searchTerms: [jobUses],
+                    fallbackValue: `uses: ${jobUses}`,
+                });
+                findings.push({
+                    rule_id: "workflow-ref-confusion",
+                    finding_id: `WORKFLOW_REF_CONFUSION-JOB-${input.filePath}-${jobIndex}`,
+                    severity: "HIGH",
+                    category: "CI_VULNERABLE_ACTION",
+                    layer: "L2",
+                    file_path: input.filePath,
+                    location: { field: `jobs.${job.id}.uses` },
+                    description: "Workflow action is pinned to a symbolic ref instead of an immutable commit hash",
+                    affected_tools: ["github-actions"],
+                    cve: null,
+                    owasp: ["ASI02"],
+                    cwe: "CWE-829",
+                    confidence: "HIGH",
+                    fixable: false,
+                    remediation_actions: ["Pin external actions to a full commit SHA"],
+                    evidence: evidence?.evidence ?? null,
+                    suppressed: false,
+                });
+            }
+        }
         for (const [stepIndex, step] of job.steps.entries()) {
             const uses = step.uses?.trim();
             if (!uses) {

package/dist/layer2-static/detectors/workflow-run-untrusted-artifact.d.ts

@@ -0,0 +1,7 @@
+import type { Finding } from "../../types/finding.js";
+export interface WorkflowRunUntrustedArtifactInput {
+    filePath: string;
+    parsed: unknown;
+    textContent: string;
+}
+export declare function detectWorkflowRunUntrustedArtifact(input: WorkflowRunUntrustedArtifactInput): Finding[];

package/dist/layer2-static/detectors/workflow-run-untrusted-artifact.js

@@ -0,0 +1,126 @@
+import { buildFindingEvidence } from "../evidence.js";
+import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
+function asRecord(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return null;
+    }
+    return value;
+}
+function hasWritePermission(value) {
+    if (typeof value === "string") {
+        return value.trim().toLowerCase() === "write-all";
+    }
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return false;
+    }
+    return Object.values(value).some((permission) => typeof permission === "string" && permission.trim().toLowerCase() === "write");
+}
+function hasIdTokenWrite(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return false;
+    }
+    const idTokenPermission = value["id-token"];
+    return (typeof idTokenPermission === "string" && idTokenPermission.trim().toLowerCase() === "write");
+}
+function hasInheritedSecrets(secrets) {
+    return typeof secrets === "string" && secrets.trim().toLowerCase() === "inherit";
+}
+function hasWorkflowRunBranchFilter(parsed) {
+    const root = asRecord(parsed);
+    const onValue = asRecord(root?.on);
+    const workflowRun = asRecord(onValue?.workflow_run);
+    if (!workflowRun) {
+        return false;
+    }
+    const branches = workflowRun.branches;
+    if (typeof branches === "string") {
+        return branches.trim().length > 0;
+    }
+    if (!Array.isArray(branches)) {
+        return false;
+    }
+    return branches.some((branch) => typeof branch === "string" && branch.trim().length > 0);
+}
+function hasWorkflowRunOriginGuard(condition) {
+    if (typeof condition !== "string") {
+        return false;
+    }
+    return /github\.event\.workflow_run\.event\s*!=\s*['"]pull_request['"]/iu.test(condition);
+}
+function hasWorkflowRunBranchGuard(condition) {
+    if (typeof condition !== "string") {
+        return false;
+    }
+    return /\bgithub\.event\.workflow_run\.head_branch\b/iu.test(condition);
+}
+function isDownloadArtifactStep(stepUses) {
+    if (typeof stepUses !== "string") {
+        return false;
+    }
+    return /^actions\/download-artifact@/iu.test(stepUses.trim());
+}
+export function detectWorkflowRunUntrustedArtifact(input) {
+    if (!isGitHubWorkflowPath(input.filePath)) {
+        return [];
+    }
+    const facts = extractWorkflowFacts(input.parsed);
+    if (!facts ||
+        !facts.triggers.some((trigger) => trigger.trim().toLowerCase() === "workflow_run")) {
+        return [];
+    }
+    const workflowHasBranchFilter = hasWorkflowRunBranchFilter(input.parsed);
+    const workflowHasWritePermission = hasWritePermission(facts.workflowPermissions);
+    const findings = [];
+    facts.jobs.forEach((job, jobIndex) => {
+        const hasArtifactDownload = job.steps.some((step) => isDownloadArtifactStep(step.uses));
+        if (!hasArtifactDownload) {
+            return;
+        }
+        const hasRunExecution = job.steps.some((step) => typeof step.run === "string" && step.run.trim().length > 0);
+        if (!hasRunExecution) {
+            return;
+        }
+        const hasPrivilegedContext = workflowHasWritePermission ||
+            hasWritePermission(job.permissions) ||
+            hasIdTokenWrite(facts.workflowPermissions) ||
+            hasIdTokenWrite(job.permissions) ||
+            hasInheritedSecrets(job.secrets);
+        if (!hasPrivilegedContext) {
+            return;
+        }
+        const hasOriginGuard = hasWorkflowRunOriginGuard(job.if);
+        const hasBranchGuard = workflowHasBranchFilter || hasWorkflowRunBranchGuard(job.if);
+        if (hasOriginGuard && hasBranchGuard) {
+            return;
+        }
+        const evidence = buildFindingEvidence({
+            textContent: input.textContent,
+            searchTerms: ["workflow_run", "actions/download-artifact", "github.event.workflow_run.event"],
+            fallbackValue: `${job.id} consumes workflow_run artifacts in privileged context without strict guards`,
+        });
+        findings.push({
+            rule_id: "workflow-run-untrusted-artifact",
+            finding_id: `WORKFLOW_RUN_UNTRUSTED_ARTIFACT-${input.filePath}-${jobIndex}`,
+            severity: "HIGH",
+            category: "CI_SUPPLY_CHAIN",
+            layer: "L2",
+            file_path: input.filePath,
+            location: { field: `jobs.${job.id}` },
+            description: "Privileged workflow_run job downloads artifacts and executes commands without strict origin and branch guards",
+            affected_tools: ["github-actions"],
+            cve: null,
+            owasp: ["ASI02"],
+            cwe: "CWE-829",
+            confidence: "HIGH",
+            fixable: false,
+            remediation_actions: [
+                "Guard workflow_run jobs with github.event.workflow_run.event != 'pull_request'",
+                "Restrict workflow_run execution to trusted branches and validate artifact contents before use",
+                "Download artifacts into temporary directories and avoid executing untrusted artifact content directly",
+            ],
+            evidence: evidence?.evidence ?? null,
+            suppressed: false,
+        });
+    });
+    return findings;
+}

package/dist/layer2-static/detectors/workflow-template-injection.js

@@ -5,11 +5,48 @@ const UNTRUSTED_TRIGGERS = new Set([
     "pull_request_target",
     "issue_comment",
     "discussion_comment",
+    "pull_request_review_comment",
     "workflow_run",
 ]);
 function hasTemplateExpression(value) {
     return typeof value === "string" && value.includes("${{");
 }
+const UNTRUSTED_EVENT_REFERENCE_PATTERNS = [
+    /\bgithub\.event\.pull_request\.(?:title|body|head\.ref|head\.label|head\.repo\.full_name)\b/iu,
+    /\bgithub\.event\.issue\.(?:title|body)\b/iu,
+    /\bgithub\.event\.comment\.body\b/iu,
+    /\bgithub\.event\.review\.body\b/iu,
+    /\bgithub\.event\.discussion\.body\b/iu,
+    /\bgithub\.head_ref\b/iu,
+];
+const PRIVILEGED_COMMAND_PATTERNS = [
+    /\bgh\s+release\b/iu,
+    /\bdeploy\b/iu,
+    /\bpublish\b/iu,
+    /\brelease\b/iu,
+    /\bcurl\b/iu,
+    /\bwget\b/iu,
+    /\bbash\b/iu,
+    /\bsh\b/iu,
+];
+function hasUntrustedEventReference(value) {
+    if (typeof value !== "string") {
+        return false;
+    }
+    return UNTRUSTED_EVENT_REFERENCE_PATTERNS.some((pattern) => pattern.test(value));
+}
+function hasUntrustedTemplateExpression(value) {
+    return hasTemplateExpression(value) && hasUntrustedEventReference(value);
+}
+function isPrivilegedStep(run, uses) {
+    if (typeof uses === "string" && uses.trim().length > 0) {
+        return true;
+    }
+    if (typeof run !== "string") {
+        return false;
+    }
+    return PRIVILEGED_COMMAND_PATTERNS.some((pattern) => pattern.test(run));
+}
 function normalizeUsesSlug(value) {
     const beforeRef = value.split("@")[0] ?? value;
     return beforeRef.replace(/\/+$/u, "").toLowerCase();
@@ -29,7 +66,31 @@ export function detectWorkflowTemplateInjection(input) {
     const findings = [];
     facts.jobs.forEach((job, jobIndex) => {
         job.steps.forEach((step, stepIndex) => {
-            if (hasTemplateExpression(step.run)) {
+            if (step.if && hasUntrustedEventReference(step.if) && isPrivilegedStep(step.run, step.uses)) {
+                findings.push({
+                    rule_id: "workflow-template-injection",
+                    finding_id: `WORKFLOW_TEMPLATE_INJECTION-CONDITION-${input.filePath}-${jobIndex}-${stepIndex}`,
+                    severity: "HIGH",
+                    category: "CI_TEMPLATE_INJECTION",
+                    layer: "L2",
+                    file_path: input.filePath,
+                    location: { field: `jobs.${job.id}.steps[${stepIndex}].if` },
+                    description: "Step condition trusts attacker-controlled issue, comment, or pull request content before privileged execution",
+                    affected_tools: ["github-actions"],
+                    cve: null,
+                    owasp: ["ASI02"],
+                    cwe: "CWE-20",
+                    confidence: "HIGH",
+                    fixable: false,
+                    remediation_actions: [
+                        "Do not gate privileged steps on raw issue/comment/pull-request text",
+                        "Require explicit allow-lists or trusted actor checks before executing privileged paths",
+                    ],
+                    evidence: step.if,
+                    suppressed: false,
+                });
+            }
+            if (hasUntrustedTemplateExpression(step.run)) {
                 findings.push({
                     rule_id: "workflow-template-injection",
                     finding_id: `WORKFLOW_TEMPLATE_INJECTION-RUN-${input.filePath}-${jobIndex}-${stepIndex}`,
@@ -58,33 +119,61 @@ export function detectWorkflowTemplateInjection(input) {
             }
             const slug = normalizeUsesSlug(uses);
             const sinkFields = sinkMap[slug];
-            if (!sinkFields || sinkFields.length === 0) {
-                return;
+            const flaggedSinkFields = new Set();
+            if (sinkFields && sinkFields.length > 0) {
+                for (const sinkField of sinkFields) {
+                    const sinkValue = step.with[sinkField];
+                    if (!hasUntrustedTemplateExpression(sinkValue)) {
+                        continue;
+                    }
+                    flaggedSinkFields.add(sinkField);
+                    findings.push({
+                        rule_id: "workflow-template-injection",
+                        finding_id: `WORKFLOW_TEMPLATE_INJECTION-SINK-${input.filePath}-${jobIndex}-${stepIndex}-${sinkField}`,
+                        severity: "HIGH",
+                        category: "CI_TEMPLATE_INJECTION",
+                        layer: "L2",
+                        file_path: input.filePath,
+                        location: { field: `jobs.${job.id}.steps[${stepIndex}].with.${sinkField}` },
+                        description: "Template expression reaches an action input known to execute code or evaluate scripts",
+                        affected_tools: ["github-actions"],
+                        cve: null,
+                        owasp: ["ASI02"],
+                        cwe: "CWE-94",
+                        confidence: "HIGH",
+                        fixable: false,
+                        remediation_actions: [
+                            "Avoid passing untrusted template expressions into code execution sink inputs",
+                        ],
+                        evidence: sinkValue,
+                        suppressed: false,
+                    });
+                }
             }
-            for (const sinkField of sinkFields) {
-                const sinkValue = step.with[sinkField];
-                if (!hasTemplateExpression(sinkValue)) {
+            for (const [inputField, inputValue] of Object.entries(step.with)) {
+                if (flaggedSinkFields.has(inputField) || !hasUntrustedTemplateExpression(inputValue)) {
                     continue;
                 }
                 findings.push({
                     rule_id: "workflow-template-injection",
-                    finding_id: `WORKFLOW_TEMPLATE_INJECTION-SINK-${input.filePath}-${jobIndex}-${stepIndex}-${sinkField}`,
-                    severity: "HIGH",
+                    finding_id: `WORKFLOW_TEMPLATE_INJECTION-WITH-${input.filePath}-${jobIndex}-${stepIndex}-${inputField}`,
+                    severity: "MEDIUM",
                     category: "CI_TEMPLATE_INJECTION",
                     layer: "L2",
                     file_path: input.filePath,
-                    location: { field: `jobs.${job.id}.steps[${stepIndex}].with.${sinkField}` },
-                    description: "Template expression reaches an action input known to execute code or evaluate scripts",
+                    location: { field: `jobs.${job.id}.steps[${stepIndex}].with.${inputField}` },
+                    description: "Action input receives attacker-controlled issue, comment, or pull request content",
                     affected_tools: ["github-actions"],
                     cve: null,
                     owasp: ["ASI02"],
-                    cwe: "CWE-94",
+                    cwe: "CWE-20",
                     confidence: "HIGH",
                     fixable: false,
                     remediation_actions: [
-                        "Avoid passing untrusted template expressions into code execution sink inputs",
+                        "Do not pass raw issue/comment/pull-request text into action inputs without validation",
+                        "Prefer explicit allow-lists and strict parsing for any user-controlled values",
                     ],
-                    evidence: sinkValue,
+                    evidence: inputValue,
                     suppressed: false,
                 });
             }

package/dist/layer2-static/detectors/workflow-unpinned-uses.js

@@ -16,6 +16,40 @@ export function detectWorkflowUnpinnedUses(input) {
     }
     const findings = [];
     facts.jobs.forEach((job, jobIndex) => {
+        const jobUses = job.uses?.trim();
+        if (jobUses && !jobUses.startsWith("./") && !jobUses.startsWith("docker://")) {
+            if (isRepositoryUses(jobUses)) {
+                const ref = jobUses.split("@").slice(1).join("@").trim();
+                if (ref.length > 0 && !isPinnedToCommit(ref)) {
+                    const evidence = buildFindingEvidence({
+                        textContent: input.textContent,
+                        searchTerms: [jobUses],
+                        fallbackValue: `uses: ${jobUses}`,
+                    });
+                    findings.push({
+                        rule_id: "workflow-unpinned-uses",
+                        finding_id: `WORKFLOW_UNPINNED_USES-JOB-${input.filePath}-${jobIndex}`,
+                        severity: "HIGH",
+                        category: "CI_SUPPLY_CHAIN",
+                        layer: "L2",
+                        file_path: input.filePath,
+                        location: { field: `jobs.${job.id}.uses` },
+                        description: "Workflow reusable reference is not pinned to an immutable commit hash",
+                        affected_tools: ["github-actions"],
+                        cve: null,
+                        owasp: ["ASI02"],
+                        cwe: "CWE-829",
+                        confidence: "HIGH",
+                        fixable: false,
+                        remediation_actions: [
+                            "Pin reusable workflows to a full commit SHA and track tag intent in comments",
+                        ],
+                        evidence: evidence?.evidence ?? null,
+                        suppressed: false,
+                    });
+                }
+            }
+        }
         job.steps.forEach((step, stepIndex) => {
             const uses = step.uses?.trim();
             if (!uses || uses.startsWith("./") || uses.startsWith("docker://")) {

package/dist/layer2-static/detectors/workflow-unsafe-checkout-ref.d.ts

@@ -0,0 +1,7 @@
+import type { Finding } from "../../types/finding.js";
+export interface WorkflowUnsafeCheckoutRefInput {
+    filePath: string;
+    parsed: unknown;
+    textContent: string;
+}
+export declare function detectWorkflowUnsafeCheckoutRef(input: WorkflowUnsafeCheckoutRefInput): Finding[];