codegate-ai 0.11.0 → 0.12.1

package/dist/layer2-static/advisories/gha-known-vulnerable-actions.json

@@ -1,4 +1,6 @@
 {
   "actions/checkout": ["v3"],
-  "tj-actions/changed-files": ["v39"]
+  "tj-actions/changed-files": ["v39"],
+  "aquasecurity/trivy-action": ["<0.35.0"],
+  "aquasecurity/setup-trivy": [">=0.1.0 <0.2.7"]
 }

package/dist/layer2-static/detectors/workflow-floating-action-version.d.ts

@@ -0,0 +1,7 @@
+import type { Finding } from "../../types/finding.js";
+export interface WorkflowFloatingActionVersionInput {
+    filePath: string;
+    parsed: unknown;
+    textContent: string;
+}
+export declare function detectWorkflowFloatingActionVersion(input: WorkflowFloatingActionVersionInput): Finding[];

package/dist/layer2-static/detectors/workflow-floating-action-version.js

@@ -0,0 +1,63 @@
+import { buildFindingEvidence } from "../evidence.js";
+import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
+const FLOATING_VERSION_VALUES = new Set(["latest", "stable", "edge", "nightly", "main", "master"]);
+const VERSION_KEY_PATTERN = /version/iu;
+function isRepositoryUses(value) {
+    if (typeof value !== "string") {
+        return false;
+    }
+    return /^[a-z0-9._-]+\/[a-z0-9._-]+(?:\/[^@]+)?@[^\s]+$/iu.test(value.trim());
+}
+function isFloatingVersionValue(value) {
+    const normalized = value.trim().toLowerCase();
+    return FLOATING_VERSION_VALUES.has(normalized);
+}
+export function detectWorkflowFloatingActionVersion(input) {
+    if (!isGitHubWorkflowPath(input.filePath)) {
+        return [];
+    }
+    const facts = extractWorkflowFacts(input.parsed);
+    if (!facts) {
+        return [];
+    }
+    const findings = [];
+    facts.jobs.forEach((job, jobIndex) => {
+        job.steps.forEach((step, stepIndex) => {
+            if (!isRepositoryUses(step.uses) || !step.with) {
+                return;
+            }
+            for (const [withKey, withValue] of Object.entries(step.with)) {
+                if (!VERSION_KEY_PATTERN.test(withKey) || !isFloatingVersionValue(withValue)) {
+                    continue;
+                }
+                const evidence = buildFindingEvidence({
+                    textContent: input.textContent,
+                    searchTerms: [step.uses ?? "", withKey, withValue],
+                    fallbackValue: `${withKey}: ${withValue}`,
+                });
+                findings.push({
+                    rule_id: "workflow-floating-action-version",
+                    finding_id: `WORKFLOW_FLOATING_ACTION_VERSION-${input.filePath}-${jobIndex}-${stepIndex}-${withKey}`,
+                    severity: "MEDIUM",
+                    category: "CI_SUPPLY_CHAIN",
+                    layer: "L2",
+                    file_path: input.filePath,
+                    location: { field: `jobs.${job.id}.steps[${stepIndex}].with.${withKey}` },
+                    description: "Action input uses a floating version selector, which can pull unexpected releases over time",
+                    affected_tools: ["github-actions"],
+                    cve: null,
+                    owasp: ["ASI02"],
+                    cwe: "CWE-1104",
+                    confidence: "HIGH",
+                    fixable: false,
+                    remediation_actions: [
+                        "Pin action input versions to explicit releases instead of mutable selectors like latest",
+                    ],
+                    evidence: evidence?.evidence ?? null,
+                    suppressed: false,
+                });
+            }
+        });
+    });
+    return findings;
+}

package/dist/layer2-static/detectors/workflow-forbidden-uses.js

@@ -104,6 +104,39 @@ export function detectWorkflowForbiddenUses(input) {
     }
     const findings = [];
     facts.jobs.forEach((job, jobIndex) => {
+        const jobUses = job.uses?.trim();
+        if (jobUses && isForbidden(jobUses, policy)) {
+            const evidence = buildFindingEvidence({
+                textContent: input.textContent,
+                searchTerms: [jobUses],
+                fallbackValue: `uses: ${jobUses}`,
+            });
+            findings.push({
+                rule_id: "workflow-forbidden-uses",
+                finding_id: `WORKFLOW_FORBIDDEN_USES-JOB-${input.filePath}-${jobIndex}`,
+                severity: "HIGH",
+                category: "CI_SUPPLY_CHAIN",
+                layer: "L2",
+                file_path: input.filePath,
+                location: { field: `jobs.${job.id}.uses` },
+                description: policy.mode === "allow"
+                    ? "Workflow uses repository action outside the configured allowlist"
+                    : "Workflow uses repository action matching the configured denylist",
+                affected_tools: ["github-actions"],
+                cve: null,
+                owasp: ["ASI02"],
+                cwe: "CWE-829",
+                confidence: "HIGH",
+                fixable: false,
+                remediation_actions: [
+                    policy.mode === "allow"
+                        ? "Add the action to the allowlist only if it is explicitly trusted"
+                        : "Remove the action or move it to an allowlist-only policy if it is trusted",
+                ],
+                evidence: evidence?.evidence ?? null,
+                suppressed: false,
+            });
+        }
         job.steps.forEach((step, stepIndex) => {
             const uses = step.uses?.trim();
             if (!uses) {

package/dist/layer2-static/detectors/workflow-github-env.js

@@ -1,7 +1,60 @@
 import { buildFindingEvidence } from "../evidence.js";
 import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
-function writesToGithubEnv(run) {
-    return typeof run === "string" && />>\s*["']?\$?\{?GITHUB_ENV\}?/iu.test(run);
+const UNTRUSTED_TRIGGERS = new Set([
+    "pull_request",
+    "pull_request_target",
+    "issue_comment",
+    "discussion_comment",
+    "pull_request_review_comment",
+    "workflow_run",
+]);
+const UNTRUSTED_EVENT_REFERENCE_PATTERNS = [
+    /\bgithub\.event\.pull_request\.(?:title|body|head\.ref|head\.label|head\.repo\.full_name)\b/iu,
+    /\bgithub\.event\.issue\.(?:title|body)\b/iu,
+    /\bgithub\.event\.comment\.body\b/iu,
+    /\bgithub\.event\.review\.body\b/iu,
+    /\bgithub\.event\.discussion\.body\b/iu,
+    /\bgithub\.head_ref\b/iu,
+];
+const COMMAND_FILE_SPECS = [
+    {
+        name: "GITHUB_ENV",
+        severity: "HIGH",
+        writePatterns: [/>>\s*["']?\$?\{?GITHUB_ENV\}?/iu, /\btee\s+-a\s+["']?\$?\{?GITHUB_ENV\}?/iu],
+    },
+    {
+        name: "GITHUB_PATH",
+        severity: "CRITICAL",
+        writePatterns: [/>>\s*["']?\$?\{?GITHUB_PATH\}?/iu, /\btee\s+-a\s+["']?\$?\{?GITHUB_PATH\}?/iu],
+    },
+    {
+        name: "GITHUB_OUTPUT",
+        severity: "HIGH",
+        writePatterns: [
+            />>\s*["']?\$?\{?GITHUB_OUTPUT\}?/iu,
+            /\btee\s+-a\s+["']?\$?\{?GITHUB_OUTPUT\}?/iu,
+        ],
+    },
+    {
+        name: "GITHUB_STATE",
+        severity: "MEDIUM",
+        writePatterns: [
+            />>\s*["']?\$?\{?GITHUB_STATE\}?/iu,
+            /\btee\s+-a\s+["']?\$?\{?GITHUB_STATE\}?/iu,
+        ],
+    },
+];
+function hasUntrustedEventReference(value) {
+    if (typeof value !== "string") {
+        return false;
+    }
+    return UNTRUSTED_EVENT_REFERENCE_PATTERNS.some((pattern) => pattern.test(value));
+}
+function collectWrittenCommandFiles(run) {
+    if (typeof run !== "string") {
+        return [];
+    }
+    return COMMAND_FILE_SPECS.filter((spec) => spec.writePatterns.some((pattern) => pattern.test(run)));
 }
 export function detectWorkflowGithubEnv(input) {
     if (!isGitHubWorkflowPath(input.filePath)) {
@@ -12,36 +65,44 @@ export function detectWorkflowGithubEnv(input) {
         return [];
     }
     const findings = [];
+    const hasUntrustedTrigger = facts.triggers.some((trigger) => UNTRUSTED_TRIGGERS.has(trigger));
     facts.jobs.forEach((job, jobIndex) => {
         job.steps.forEach((step, stepIndex) => {
-            if (!writesToGithubEnv(step.run)) {
+            const writtenCommandFiles = collectWrittenCommandFiles(step.run);
+            if (writtenCommandFiles.length === 0) {
                 return;
             }
-            const evidence = buildFindingEvidence({
-                textContent: input.textContent,
-                searchTerms: [step.run ?? "", "GITHUB_ENV"],
-                fallbackValue: step.run ?? "write to GITHUB_ENV",
-            });
-            findings.push({
-                rule_id: "workflow-github-env",
-                finding_id: `WORKFLOW_GITHUB_ENV-${input.filePath}-${jobIndex}-${stepIndex}`,
-                severity: "HIGH",
-                category: "CI_SUPPLY_CHAIN",
-                layer: "L2",
-                file_path: input.filePath,
-                location: { field: `jobs.${job.id}.steps[${stepIndex}].run` },
-                description: "Run step writes to GITHUB_ENV",
-                affected_tools: ["github-actions"],
-                cve: null,
-                owasp: ["ASI02"],
-                cwe: "CWE-94",
-                confidence: "HIGH",
-                fixable: false,
-                remediation_actions: [
-                    "Avoid writing attacker-controlled values to GITHUB_ENV and prefer validated environment variables",
-                ],
-                evidence: evidence?.evidence ?? null,
-                suppressed: false,
+            if (!hasUntrustedTrigger && !hasUntrustedEventReference(step.run)) {
+                return;
+            }
+            writtenCommandFiles.forEach((commandFile) => {
+                const evidence = buildFindingEvidence({
+                    textContent: input.textContent,
+                    searchTerms: [step.run ?? "", commandFile.name],
+                    fallbackValue: step.run ?? `write to ${commandFile.name}`,
+                });
+                findings.push({
+                    rule_id: "workflow-command-file-poisoning",
+                    finding_id: `WORKFLOW_COMMAND_FILE_POISONING-${commandFile.name}-${input.filePath}-${jobIndex}-${stepIndex}`,
+                    severity: commandFile.severity,
+                    category: "CI_TEMPLATE_INJECTION",
+                    layer: "L2",
+                    file_path: input.filePath,
+                    location: { field: `jobs.${job.id}.steps[${stepIndex}].run` },
+                    description: `Run step writes to ${commandFile.name} in an untrusted workflow context`,
+                    affected_tools: ["github-actions"],
+                    cve: null,
+                    owasp: ["ASI02"],
+                    cwe: "CWE-94",
+                    confidence: "HIGH",
+                    fixable: false,
+                    remediation_actions: [
+                        "Avoid writing attacker-controlled values into GitHub command files",
+                        "Use strict allow-lists and sanitization before propagating untrusted data between workflow steps",
+                    ],
+                    evidence: evidence?.evidence ?? null,
+                    suppressed: false,
+                });
             });
         });
     });

package/dist/layer2-static/detectors/workflow-known-vuln-action.js

@@ -16,6 +16,74 @@ function parseRepositoryUses(value) {
     }
     return { slug, ref };
 }
+function parseSemverLike(value) {
+    const match = value.trim().match(/^v?(\d+)(?:\.(\d+))?(?:\.(\d+))?(?:[-+].*)?$/iu);
+    if (!match?.[1]) {
+        return null;
+    }
+    return [
+        Number.parseInt(match[1], 10),
+        Number.parseInt(match[2] ?? "0", 10),
+        Number.parseInt(match[3] ?? "0", 10),
+    ];
+}
+function compareSemverLike(left, right) {
+    for (let index = 0; index < 3; index += 1) {
+        if (left[index] < right[index]) {
+            return -1;
+        }
+        if (left[index] > right[index]) {
+            return 1;
+        }
+    }
+    return 0;
+}
+function matchesComparator(ref, comparator) {
+    const match = comparator.trim().match(/^(<=|>=|<|>|=)\s*(v?\d+(?:\.\d+){0,2})$/iu);
+    if (!match?.[1] || !match[2]) {
+        return false;
+    }
+    const refVersion = parseSemverLike(ref);
+    const comparatorVersion = parseSemverLike(match[2]);
+    if (!refVersion || !comparatorVersion) {
+        return false;
+    }
+    const comparison = compareSemverLike(refVersion, comparatorVersion);
+    switch (match[1]) {
+        case "<":
+            return comparison < 0;
+        case "<=":
+            return comparison <= 0;
+        case ">":
+            return comparison > 0;
+        case ">=":
+            return comparison >= 0;
+        case "=":
+            return comparison === 0;
+        default:
+            return false;
+    }
+}
+function matchesVulnerablePattern(ref, pattern) {
+    const normalizedRef = ref.trim().toLowerCase();
+    const normalizedPattern = pattern.trim().toLowerCase();
+    if (normalizedPattern.length === 0) {
+        return false;
+    }
+    if (normalizedPattern.includes("*")) {
+        return normalizedPattern.endsWith("*")
+            ? normalizedRef.startsWith(normalizedPattern.slice(0, -1))
+            : normalizedRef === normalizedPattern;
+    }
+    if (/^(?:<=|>=|<|>|=)/u.test(normalizedPattern)) {
+        const comparators = normalizedPattern.split(/\s+/u).filter((token) => token.length > 0);
+        return comparators.every((comparator) => matchesComparator(normalizedRef, comparator));
+    }
+    return normalizedRef === normalizedPattern;
+}
+function isKnownVulnerableRef(ref, patterns) {
+    return patterns.some((pattern) => matchesVulnerablePattern(ref, pattern));
+}
 export function detectWorkflowKnownVulnAction(input) {
     if (input.runtimeMode !== "online") {
         return [];
@@ -30,6 +98,36 @@ export function detectWorkflowKnownVulnAction(input) {
     const advisories = loadKnownVulnerableActions({ runtimeMode: input.runtimeMode }).advisories;
     const findings = [];
     facts.jobs.forEach((job, jobIndex) => {
+        const jobUses = job.uses;
+        if (jobUses) {
+            const parsedJobUses = parseRepositoryUses(jobUses);
+            if (parsedJobUses) {
+                const vulnerableVersions = advisories[parsedJobUses.slug];
+                if (vulnerableVersions && isKnownVulnerableRef(parsedJobUses.ref, vulnerableVersions)) {
+                    findings.push({
+                        rule_id: "workflow-known-vuln-action",
+                        finding_id: `WORKFLOW_KNOWN_VULN_ACTION-JOB-${input.filePath}-${jobIndex}`,
+                        severity: "HIGH",
+                        category: "CI_VULNERABLE_ACTION",
+                        layer: "L2",
+                        file_path: input.filePath,
+                        location: { field: `jobs.${job.id}.uses` },
+                        description: `Action ${parsedJobUses.slug}@${parsedJobUses.ref} is listed in known vulnerable references`,
+                        affected_tools: ["github-actions"],
+                        cve: null,
+                        owasp: ["ASI02"],
+                        cwe: "CWE-937",
+                        confidence: "HIGH",
+                        fixable: false,
+                        remediation_actions: [
+                            "Upgrade to a non-vulnerable action release and pin to a reviewed commit SHA",
+                        ],
+                        evidence: jobUses,
+                        suppressed: false,
+                    });
+                }
+            }
+        }
         job.steps.forEach((step, stepIndex) => {
             const uses = step.uses;
             if (!uses) {
@@ -40,7 +138,7 @@ export function detectWorkflowKnownVulnAction(input) {
                 return;
             }
             const vulnerableVersions = advisories[parsedUses.slug];
-            if (!vulnerableVersions || !vulnerableVersions.includes(parsedUses.ref)) {
+            if (!vulnerableVersions || !isKnownVulnerableRef(parsedUses.ref, vulnerableVersions)) {
                 return;
             }
             findings.push({

package/dist/layer2-static/detectors/workflow-ref-confusion.js

@@ -30,6 +30,36 @@ export function detectWorkflowRefConfusion(input) {
     }
     const findings = [];
     for (const [jobIndex, job] of facts.jobs.entries()) {
+        const jobUses = job.uses?.trim();
+        if (jobUses) {
+            const parsedJobUses = parseRepositoryUses(jobUses);
+            if (parsedJobUses && !isHashPinned(parsedJobUses.ref)) {
+                const evidence = buildFindingEvidence({
+                    textContent: input.textContent,
+                    searchTerms: [jobUses],
+                    fallbackValue: `uses: ${jobUses}`,
+                });
+                findings.push({
+                    rule_id: "workflow-ref-confusion",
+                    finding_id: `WORKFLOW_REF_CONFUSION-JOB-${input.filePath}-${jobIndex}`,
+                    severity: "HIGH",
+                    category: "CI_VULNERABLE_ACTION",
+                    layer: "L2",
+                    file_path: input.filePath,
+                    location: { field: `jobs.${job.id}.uses` },
+                    description: "Workflow action is pinned to a symbolic ref instead of an immutable commit hash",
+                    affected_tools: ["github-actions"],
+                    cve: null,
+                    owasp: ["ASI02"],
+                    cwe: "CWE-829",
+                    confidence: "HIGH",
+                    fixable: false,
+                    remediation_actions: ["Pin external actions to a full commit SHA"],
+                    evidence: evidence?.evidence ?? null,
+                    suppressed: false,
+                });
+            }
+        }
         for (const [stepIndex, step] of job.steps.entries()) {
             const uses = step.uses?.trim();
             if (!uses) {

package/dist/layer2-static/detectors/workflow-run-untrusted-artifact.d.ts

@@ -0,0 +1,7 @@
+import type { Finding } from "../../types/finding.js";
+export interface WorkflowRunUntrustedArtifactInput {
+    filePath: string;
+    parsed: unknown;
+    textContent: string;
+}
+export declare function detectWorkflowRunUntrustedArtifact(input: WorkflowRunUntrustedArtifactInput): Finding[];

package/dist/layer2-static/detectors/workflow-run-untrusted-artifact.js

@@ -0,0 +1,126 @@
+import { buildFindingEvidence } from "../evidence.js";
+import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
+function asRecord(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return null;
+    }
+    return value;
+}
+function hasWritePermission(value) {
+    if (typeof value === "string") {
+        return value.trim().toLowerCase() === "write-all";
+    }
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return false;
+    }
+    return Object.values(value).some((permission) => typeof permission === "string" && permission.trim().toLowerCase() === "write");
+}
+function hasIdTokenWrite(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return false;
+    }
+    const idTokenPermission = value["id-token"];
+    return (typeof idTokenPermission === "string" && idTokenPermission.trim().toLowerCase() === "write");
+}
+function hasInheritedSecrets(secrets) {
+    return typeof secrets === "string" && secrets.trim().toLowerCase() === "inherit";
+}
+function hasWorkflowRunBranchFilter(parsed) {
+    const root = asRecord(parsed);
+    const onValue = asRecord(root?.on);
+    const workflowRun = asRecord(onValue?.workflow_run);
+    if (!workflowRun) {
+        return false;
+    }
+    const branches = workflowRun.branches;
+    if (typeof branches === "string") {
+        return branches.trim().length > 0;
+    }
+    if (!Array.isArray(branches)) {
+        return false;
+    }
+    return branches.some((branch) => typeof branch === "string" && branch.trim().length > 0);
+}
+function hasWorkflowRunOriginGuard(condition) {
+    if (typeof condition !== "string") {
+        return false;
+    }
+    return /github\.event\.workflow_run\.event\s*!=\s*['"]pull_request['"]/iu.test(condition);
+}
+function hasWorkflowRunBranchGuard(condition) {
+    if (typeof condition !== "string") {
+        return false;
+    }
+    return /\bgithub\.event\.workflow_run\.head_branch\b/iu.test(condition);
+}
+function isDownloadArtifactStep(stepUses) {
+    if (typeof stepUses !== "string") {
+        return false;
+    }
+    return /^actions\/download-artifact@/iu.test(stepUses.trim());
+}
+export function detectWorkflowRunUntrustedArtifact(input) {
+    if (!isGitHubWorkflowPath(input.filePath)) {
+        return [];
+    }
+    const facts = extractWorkflowFacts(input.parsed);
+    if (!facts ||
+        !facts.triggers.some((trigger) => trigger.trim().toLowerCase() === "workflow_run")) {
+        return [];
+    }
+    const workflowHasBranchFilter = hasWorkflowRunBranchFilter(input.parsed);
+    const workflowHasWritePermission = hasWritePermission(facts.workflowPermissions);
+    const findings = [];
+    facts.jobs.forEach((job, jobIndex) => {
+        const hasArtifactDownload = job.steps.some((step) => isDownloadArtifactStep(step.uses));
+        if (!hasArtifactDownload) {
+            return;
+        }
+        const hasRunExecution = job.steps.some((step) => typeof step.run === "string" && step.run.trim().length > 0);
+        if (!hasRunExecution) {
+            return;
+        }
+        const hasPrivilegedContext = workflowHasWritePermission ||
+            hasWritePermission(job.permissions) ||
+            hasIdTokenWrite(facts.workflowPermissions) ||
+            hasIdTokenWrite(job.permissions) ||
+            hasInheritedSecrets(job.secrets);
+        if (!hasPrivilegedContext) {
+            return;
+        }
+        const hasOriginGuard = hasWorkflowRunOriginGuard(job.if);
+        const hasBranchGuard = workflowHasBranchFilter || hasWorkflowRunBranchGuard(job.if);
+        if (hasOriginGuard && hasBranchGuard) {
+            return;
+        }
+        const evidence = buildFindingEvidence({
+            textContent: input.textContent,
+            searchTerms: ["workflow_run", "actions/download-artifact", "github.event.workflow_run.event"],
+            fallbackValue: `${job.id} consumes workflow_run artifacts in privileged context without strict guards`,
+        });
+        findings.push({
+            rule_id: "workflow-run-untrusted-artifact",
+            finding_id: `WORKFLOW_RUN_UNTRUSTED_ARTIFACT-${input.filePath}-${jobIndex}`,
+            severity: "HIGH",
+            category: "CI_SUPPLY_CHAIN",
+            layer: "L2",
+            file_path: input.filePath,
+            location: { field: `jobs.${job.id}` },
+            description: "Privileged workflow_run job downloads artifacts and executes commands without strict origin and branch guards",
+            affected_tools: ["github-actions"],
+            cve: null,
+            owasp: ["ASI02"],
+            cwe: "CWE-829",
+            confidence: "HIGH",
+            fixable: false,
+            remediation_actions: [
+                "Guard workflow_run jobs with github.event.workflow_run.event != 'pull_request'",
+                "Restrict workflow_run execution to trusted branches and validate artifact contents before use",
+                "Download artifacts into temporary directories and avoid executing untrusted artifact content directly",
+            ],
+            evidence: evidence?.evidence ?? null,
+            suppressed: false,
+        });
+    });
+    return findings;
+}

package/dist/layer2-static/detectors/workflow-template-injection.js

@@ -5,11 +5,48 @@ const UNTRUSTED_TRIGGERS = new Set([
     "pull_request_target",
     "issue_comment",
     "discussion_comment",
+    "pull_request_review_comment",
     "workflow_run",
 ]);
 function hasTemplateExpression(value) {
     return typeof value === "string" && value.includes("${{");
 }
+const UNTRUSTED_EVENT_REFERENCE_PATTERNS = [
+    /\bgithub\.event\.pull_request\.(?:title|body|head\.ref|head\.label|head\.repo\.full_name)\b/iu,
+    /\bgithub\.event\.issue\.(?:title|body)\b/iu,
+    /\bgithub\.event\.comment\.body\b/iu,
+    /\bgithub\.event\.review\.body\b/iu,
+    /\bgithub\.event\.discussion\.body\b/iu,
+    /\bgithub\.head_ref\b/iu,
+];
+const PRIVILEGED_COMMAND_PATTERNS = [
+    /\bgh\s+release\b/iu,
+    /\bdeploy\b/iu,
+    /\bpublish\b/iu,
+    /\brelease\b/iu,
+    /\bcurl\b/iu,
+    /\bwget\b/iu,
+    /\bbash\b/iu,
+    /\bsh\b/iu,
+];
+function hasUntrustedEventReference(value) {
+    if (typeof value !== "string") {
+        return false;
+    }
+    return UNTRUSTED_EVENT_REFERENCE_PATTERNS.some((pattern) => pattern.test(value));
+}
+function hasUntrustedTemplateExpression(value) {
+    return hasTemplateExpression(value) && hasUntrustedEventReference(value);
+}
+function isPrivilegedStep(run, uses) {
+    if (typeof uses === "string" && uses.trim().length > 0) {
+        return true;
+    }
+    if (typeof run !== "string") {
+        return false;
+    }
+    return PRIVILEGED_COMMAND_PATTERNS.some((pattern) => pattern.test(run));
+}
 function normalizeUsesSlug(value) {
     const beforeRef = value.split("@")[0] ?? value;
     return beforeRef.replace(/\/+$/u, "").toLowerCase();
@@ -29,7 +66,31 @@ export function detectWorkflowTemplateInjection(input) {
     const findings = [];
     facts.jobs.forEach((job, jobIndex) => {
         job.steps.forEach((step, stepIndex) => {
-            if (hasTemplateExpression(step.run)) {
+            if (step.if && hasUntrustedEventReference(step.if) && isPrivilegedStep(step.run, step.uses)) {
+                findings.push({
+                    rule_id: "workflow-template-injection",
+                    finding_id: `WORKFLOW_TEMPLATE_INJECTION-CONDITION-${input.filePath}-${jobIndex}-${stepIndex}`,
+                    severity: "HIGH",
+                    category: "CI_TEMPLATE_INJECTION",
+                    layer: "L2",
+                    file_path: input.filePath,
+                    location: { field: `jobs.${job.id}.steps[${stepIndex}].if` },
+                    description: "Step condition trusts attacker-controlled issue, comment, or pull request content before privileged execution",
+                    affected_tools: ["github-actions"],
+                    cve: null,
+                    owasp: ["ASI02"],
+                    cwe: "CWE-20",
+                    confidence: "HIGH",
+                    fixable: false,
+                    remediation_actions: [
+                        "Do not gate privileged steps on raw issue/comment/pull-request text",
+                        "Require explicit allow-lists or trusted actor checks before executing privileged paths",
+                    ],
+                    evidence: step.if,
+                    suppressed: false,
+                });
+            }
+            if (hasUntrustedTemplateExpression(step.run)) {
                 findings.push({
                     rule_id: "workflow-template-injection",
                     finding_id: `WORKFLOW_TEMPLATE_INJECTION-RUN-${input.filePath}-${jobIndex}-${stepIndex}`,
@@ -58,33 +119,61 @@ export function detectWorkflowTemplateInjection(input) {
             }
             const slug = normalizeUsesSlug(uses);
             const sinkFields = sinkMap[slug];
-            if (!sinkFields || sinkFields.length === 0) {
-                return;
+            const flaggedSinkFields = new Set();
+            if (sinkFields && sinkFields.length > 0) {
+                for (const sinkField of sinkFields) {
+                    const sinkValue = step.with[sinkField];
+                    if (!hasUntrustedTemplateExpression(sinkValue)) {
+                        continue;
+                    }
+                    flaggedSinkFields.add(sinkField);
+                    findings.push({
+                        rule_id: "workflow-template-injection",
+                        finding_id: `WORKFLOW_TEMPLATE_INJECTION-SINK-${input.filePath}-${jobIndex}-${stepIndex}-${sinkField}`,
+                        severity: "HIGH",
+                        category: "CI_TEMPLATE_INJECTION",
+                        layer: "L2",
+                        file_path: input.filePath,
+                        location: { field: `jobs.${job.id}.steps[${stepIndex}].with.${sinkField}` },
+                        description: "Template expression reaches an action input known to execute code or evaluate scripts",
+                        affected_tools: ["github-actions"],
+                        cve: null,
+                        owasp: ["ASI02"],
+                        cwe: "CWE-94",
+                        confidence: "HIGH",
+                        fixable: false,
+                        remediation_actions: [
+                            "Avoid passing untrusted template expressions into code execution sink inputs",
+                        ],
+                        evidence: sinkValue,
+                        suppressed: false,
+                    });
+                }
             }
-            for (const sinkField of sinkFields) {
-                const sinkValue = step.with[sinkField];
-                if (!hasTemplateExpression(sinkValue)) {
+            for (const [inputField, inputValue] of Object.entries(step.with)) {
+                if (flaggedSinkFields.has(inputField) || !hasUntrustedTemplateExpression(inputValue)) {
                     continue;
                 }
                 findings.push({
                     rule_id: "workflow-template-injection",
-                    finding_id: `WORKFLOW_TEMPLATE_INJECTION-SINK-${input.filePath}-${jobIndex}-${stepIndex}-${sinkField}`,
-                    severity: "HIGH",
+                    finding_id: `WORKFLOW_TEMPLATE_INJECTION-WITH-${input.filePath}-${jobIndex}-${stepIndex}-${inputField}`,
+                    severity: "MEDIUM",
                     category: "CI_TEMPLATE_INJECTION",
                     layer: "L2",
                     file_path: input.filePath,
-                    location: { field: `jobs.${job.id}.steps[${stepIndex}].with.${sinkField}` },
-                    description: "Template expression reaches an action input known to execute code or evaluate scripts",
+                    location: { field: `jobs.${job.id}.steps[${stepIndex}].with.${inputField}` },
+                    description: "Action input receives attacker-controlled issue, comment, or pull request content",
                     affected_tools: ["github-actions"],
                     cve: null,
                     owasp: ["ASI02"],
-                    cwe: "CWE-94",
+                    cwe: "CWE-20",
                     confidence: "HIGH",
                     fixable: false,
                     remediation_actions: [
-                        "Avoid passing untrusted template expressions into code execution sink inputs",
+                        "Do not pass raw issue/comment/pull-request text into action inputs without validation",
+                        "Prefer explicit allow-lists and strict parsing for any user-controlled values",
                     ],
-                    evidence: sinkValue,
+                    evidence: inputValue,
                     suppressed: false,
                 });
             }

package/dist/layer2-static/detectors/workflow-unpinned-uses.js

@@ -16,6 +16,40 @@ export function detectWorkflowUnpinnedUses(input) {
     }
     const findings = [];
     facts.jobs.forEach((job, jobIndex) => {
+        const jobUses = job.uses?.trim();
+        if (jobUses && !jobUses.startsWith("./") && !jobUses.startsWith("docker://")) {
+            if (isRepositoryUses(jobUses)) {
+                const ref = jobUses.split("@").slice(1).join("@").trim();
+                if (ref.length > 0 && !isPinnedToCommit(ref)) {
+                    const evidence = buildFindingEvidence({
+                        textContent: input.textContent,
+                        searchTerms: [jobUses],
+                        fallbackValue: `uses: ${jobUses}`,
+                    });
+                    findings.push({
+                        rule_id: "workflow-unpinned-uses",
+                        finding_id: `WORKFLOW_UNPINNED_USES-JOB-${input.filePath}-${jobIndex}`,
+                        severity: "HIGH",
+                        category: "CI_SUPPLY_CHAIN",
+                        layer: "L2",
+                        file_path: input.filePath,
+                        location: { field: `jobs.${job.id}.uses` },
+                        description: "Workflow reusable reference is not pinned to an immutable commit hash",
+                        affected_tools: ["github-actions"],
+                        cve: null,
+                        owasp: ["ASI02"],
+                        cwe: "CWE-829",
+                        confidence: "HIGH",
+                        fixable: false,
+                        remediation_actions: [
+                            "Pin reusable workflows to a full commit SHA and track tag intent in comments",
+                        ],
+                        evidence: evidence?.evidence ?? null,
+                        suppressed: false,
+                    });
+                }
+            }
+        }
         job.steps.forEach((step, stepIndex) => {
             const uses = step.uses?.trim();
             if (!uses || uses.startsWith("./") || uses.startsWith("docker://")) {

package/dist/layer2-static/detectors/workflow-unsafe-checkout-ref.d.ts

@@ -0,0 +1,7 @@
+import type { Finding } from "../../types/finding.js";
+export interface WorkflowUnsafeCheckoutRefInput {
+    filePath: string;
+    parsed: unknown;
+    textContent: string;
+}
+export declare function detectWorkflowUnsafeCheckoutRef(input: WorkflowUnsafeCheckoutRefInput): Finding[];

package/dist/layer2-static/detectors/workflow-unsafe-checkout-ref.js

@@ -0,0 +1,102 @@
+import { buildFindingEvidence } from "../evidence.js";
+import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
+const UNTRUSTED_REF_PATTERNS = [
+    /\bgithub\.event\.pull_request\.head\.ref\b/iu,
+    /\bgithub\.head_ref\b/iu,
+    /\bgithub\.event\.workflow_run\.head_branch\b/iu,
+];
+function hasWritePermission(value) {
+    if (typeof value === "string") {
+        return value.trim().toLowerCase() === "write-all";
+    }
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return false;
+    }
+    return Object.values(value).some((permission) => typeof permission === "string" && permission.trim().toLowerCase() === "write");
+}
+function hasIdTokenWrite(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return false;
+    }
+    const idTokenPermission = value["id-token"];
+    return (typeof idTokenPermission === "string" && idTokenPermission.trim().toLowerCase() === "write");
+}
+function hasInheritedSecrets(secrets) {
+    return typeof secrets === "string" && secrets.trim().toLowerCase() === "inherit";
+}
+function isCheckoutStep(stepUses) {
+    if (typeof stepUses !== "string") {
+        return false;
+    }
+    return /^actions\/checkout@/iu.test(stepUses.trim());
+}
+function hasUnsafeRef(ref) {
+    if (typeof ref !== "string") {
+        return false;
+    }
+    return UNTRUSTED_REF_PATTERNS.some((pattern) => pattern.test(ref));
+}
+export function detectWorkflowUnsafeCheckoutRef(input) {
+    if (!isGitHubWorkflowPath(input.filePath)) {
+        return [];
+    }
+    const facts = extractWorkflowFacts(input.parsed);
+    if (!facts) {
+        return [];
+    }
+    const hasRelevantTrigger = facts.triggers.some((trigger) => {
+        const normalized = trigger.trim().toLowerCase();
+        return normalized === "pull_request_target" || normalized === "workflow_run";
+    });
+    if (!hasRelevantTrigger) {
+        return [];
+    }
+    const workflowPrivileged = hasWritePermission(facts.workflowPermissions) || hasIdTokenWrite(facts.workflowPermissions);
+    const findings = [];
+    facts.jobs.forEach((job, jobIndex) => {
+        const jobPrivileged = workflowPrivileged ||
+            hasWritePermission(job.permissions) ||
+            hasIdTokenWrite(job.permissions) ||
+            hasInheritedSecrets(job.secrets);
+        if (!jobPrivileged) {
+            return;
+        }
+        job.steps.forEach((step, stepIndex) => {
+            if (!isCheckoutStep(step.uses)) {
+                return;
+            }
+            const refValue = step.with?.ref;
+            if (!hasUnsafeRef(refValue)) {
+                return;
+            }
+            const evidence = buildFindingEvidence({
+                textContent: input.textContent,
+                searchTerms: [step.uses ?? "", refValue ?? "", "head.ref", "head_branch"],
+                fallbackValue: `jobs.${job.id}.steps[${stepIndex}].with.ref`,
+            });
+            findings.push({
+                rule_id: "workflow-unsafe-checkout-ref",
+                finding_id: `WORKFLOW_UNSAFE_CHECKOUT_REF-${input.filePath}-${jobIndex}-${stepIndex}`,
+                severity: "HIGH",
+                category: "CI_TEMPLATE_INJECTION",
+                layer: "L2",
+                file_path: input.filePath,
+                location: { field: `jobs.${job.id}.steps[${stepIndex}].with.ref` },
+                description: "Privileged checkout references attacker-influenced ref names; prefer immutable commit SHA values",
+                affected_tools: ["github-actions"],
+                cve: null,
+                owasp: ["ASI02"],
+                cwe: "CWE-20",
+                confidence: "HIGH",
+                fixable: false,
+                remediation_actions: [
+                    "Use github.event.pull_request.head.sha (or an immutable SHA) instead of head.ref/head_branch values",
+                    "Avoid checking out attacker-controlled refs in privileged workflows",
+                ],
+                evidence: evidence?.evidence ?? refValue ?? null,
+                suppressed: false,
+            });
+        });
+    });
+    return findings;
+}

package/dist/layer2-static/engine.js

@@ -15,6 +15,7 @@ import { detectWorkflowUnpinnedUses } from "./detectors/workflow-unpinned-uses.j
 import { detectWorkflowArtipacked } from "./detectors/workflow-artipacked.js";
 import { detectWorkflowCachePoisoning } from "./detectors/workflow-cache-poisoning.js";
 import { detectWorkflowGithubEnv } from "./detectors/workflow-github-env.js";
+import { detectWorkflowRunUntrustedArtifact } from "./detectors/workflow-run-untrusted-artifact.js";
 import { detectWorkflowInsecureCommands } from "./detectors/workflow-insecure-commands.js";
 import { detectWorkflowSelfHostedRunner } from "./detectors/workflow-self-hosted-runner.js";
 import { detectWorkflowOverprovisionedSecrets } from "./detectors/workflow-overprovisioned-secrets.js";
@@ -28,7 +29,9 @@ import { detectWorkflowForbiddenUses } from "./detectors/workflow-forbidden-uses
 import { detectWorkflowRefConfusion } from "./detectors/workflow-ref-confusion.js";
 import { detectWorkflowRefVersionMismatch } from "./detectors/workflow-ref-version-mismatch.js";
 import { detectWorkflowImpostorCommit } from "./detectors/workflow-impostor-commit.js";
+import { detectWorkflowUnsafeCheckoutRef } from "./detectors/workflow-unsafe-checkout-ref.js";
 import { detectWorkflowUnpinnedImages } from "./detectors/workflow-unpinned-images.js";
+import { detectWorkflowFloatingActionVersion } from "./detectors/workflow-floating-action-version.js";
 import { detectWorkflowAnonymousDefinition } from "./detectors/workflow-anonymous-definition.js";
 import { detectWorkflowConcurrencyLimits } from "./detectors/workflow-concurrency-limits.js";
 import { detectWorkflowSuperfluousActions } from "./detectors/workflow-superfluous-actions.js";
@@ -307,6 +310,16 @@ function buildFileAudits() {
                 })
                 : [],
         },
+        {
+            id: "workflow-run-untrusted-artifact",
+            run: ({ file, input }) => input.config.workflowAuditsEnabled
+                ? detectWorkflowRunUntrustedArtifact({
+                    filePath: file.filePath,
+                    parsed: file.parsed,
+                    textContent: file.textContent,
+                })
+                : [],
+        },
         {
             id: "workflow-insecure-commands",
             run: ({ file, input }) => input.config.workflowAuditsEnabled
@@ -432,6 +445,26 @@ function buildFileAudits() {
                 })
                 : [],
         },
+        {
+            id: "workflow-unsafe-checkout-ref",
+            run: ({ file, input }) => input.config.workflowAuditsEnabled
+                ? detectWorkflowUnsafeCheckoutRef({
+                    filePath: file.filePath,
+                    parsed: file.parsed,
+                    textContent: file.textContent,
+                })
+                : [],
+        },
+        {
+            id: "workflow-floating-action-version",
+            run: ({ file, input }) => input.config.workflowAuditsEnabled
+                ? detectWorkflowFloatingActionVersion({
+                    filePath: file.filePath,
+                    parsed: file.parsed,
+                    textContent: file.textContent,
+                })
+                : [],
+        },
         {
             id: "workflow-impostor-commit",
             onlineRequired: true,

package/dist/layer2-static/github/client.js

@@ -9,6 +9,15 @@ function normalizeAdvisoryMap(value) {
     }
     return normalized;
 }
+function mergeAdvisoryMaps(bundled, cached) {
+    const merged = {};
+    const allKeys = new Set([...Object.keys(bundled), ...Object.keys(cached)]);
+    for (const key of allKeys) {
+        const versions = new Set([...(bundled[key] ?? []), ...(cached[key] ?? [])]);
+        merged[key] = Array.from(versions);
+    }
+    return merged;
+}
 export function createGithubMetadataClient(options = {}) {
     const runtimeMode = options.runtimeMode ?? "offline";
     const cacheDir = options.cacheDir ?? join(homedir(), ".codegate", "cache");
@@ -31,7 +40,10 @@ export function createGithubMetadataClient(options = {}) {
             }
             const cached = loadCachedAdvisoryPayload(cacheDir, cacheMaxAgeMs, now);
             if (cached) {
-                return cached;
+                return {
+                    generatedAt: Math.max(payload.generatedAt, cached.generatedAt),
+                    advisories: mergeAdvisoryMaps(payload.advisories, cached.advisories),
+                };
             }
             saveCachedAdvisoryPayload(cacheDir, payload);
             return payload;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codegate-ai",
-  "version": "0.11.0",
+  "version": "0.12.1",
   "description": "Pre-flight security scanner for AI coding tool configurations.",
   "license": "MIT",
   "type": "module",